Luzerne County still recovering from cyber attack

June 04-- Jun. 4--As Luzerne County's recovery from a cyber attack continues, officials said much of the expense should be covered by insurance.

The county has purchased a cyber risk policy under its general liability insurance coverage through The Travelers Companies Inc., commonly known as Travelers, since 2018, possibly longer, county Chief Solicitor Romilda Crocamo said Monday.

This policy covers security breach remediation and computer programming and electronic data restoration expenses, Crocamo said.

After notifying the insurer the county was activating a claim, the county has selected a different outside vendor to assist with the remediation, she said.

The county had initially retained Florida-based cyber forensics firm Sylint Group, Inc. but switched to New York City-based Arete Advisors because it also is experienced and would be covered by the cyber risk policy, Crocamo said.

Working with Microsoft Corp. and county information technology staffers, Arete has performed a full assessment, known as a remediation, to determine what remains infected and must be fixed, said county Administrative Services Division Head David Parsnik.

The testing was performed throughout the weekend and continued Monday, and the administration expected results Monday night verifying which machines and servers were clean or damaged, Parsnik said.

There are approximately 16 servers on the county courthouse network that was targeted, with each holding specific types of data, including property assessment records, budgetary and financial information and employee time clock reports, he said.

The county has started rebuilding a new clean network but can't reactivate employee access to servers until these systems are fully inspected, Parsnik said, noting corrupted servers also must be rebuilt.

The shutdown of computers early last week was necessary to prevent spreading of the virus, which was detected by the county's network monitoring systems on Saturday, May 25, during the long Memorial Day weekend, Parsnik has said. The unknown attackers likely got into the system through an email attachment unknowingly opened by a worker, he said.

Workers in many county offices have been unable to access data or upload documents and information handled by their departments, including property assessment records, deeds and civil court filings.

Some virus-free computer equipment is being distributed to offices and hooked up to the clean network, which will allow view-only access to limited data, he said.

Parsnik was cautiously optimistic most, if not all, servers would be restored by the end of this week.

"The biggest delay now is how long it takes to rebuild and download servers that are corrupted," Parsnik said. "As each day goes by, we'll be able to deploy more and more servers."

While departments are following contingency plans designed to operate during emergencies, county Manager C. David Pedri said Monday the shutdown has disrupted access needed to perform daily functions in three departments -- assessor's, mapping and deeds.

Pedri expected temporary computers and read-only access to data would be provided to all three Tuesday, allowing those workers to respond to customer inquiries and perform work outside of uploading new data.

The administration also emphasized the prison has not stopped administering medication to inmates or processing inmate releases because paper records are still kept.

"We're open for business in all locations," Pedri said.

Reach Jennifer Learn-Andes at 570-991-6388 or on Twitter @TLJenLearnAndes.

___

(c)2019 The Times Leader (Wilkes-Barre, Pa.)

Visit The Times Leader (Wilkes-Barre, Pa.) at www.timesleader.com

Distributed by Tribune Content Agency, LLC.