AUGUSTA — A malicious piece of software that froze the entire city computer network and forced the closure of City Center has been removed.

City officials said Friday that the software, discovered around 3:20 a.m. Thursday when police computers began shutting down — followed by the rest of the city’s servers and computer network, prompting them to close City Center on Thursday and Friday — has been removed. They said work was underway, expected to continue through the weekend, to restore the network and reload the array of data and software needed to return city computers to full functionality.

City Center is expected to reopen Monday morning at the usual time of 7:45 a.m., though not all services will have been restored fully by then.

Police Department computers were returned to action Friday afternoon, restoring the ability of dispatchers — who were keeping track of the activities and whereabouts of officers, firefighters and ambulance crews in handwriting — to use computers for dispatching and recordkeeping. The cyberattack did not take out the city’s phone system or public safety radios.

“We’re pretty much back up and running, dispatch is working as it was before,” police Chief Jared Mills said. “Obviously public safety was a priority.”

The ability to take credit card payments at the Hatch Hill landfill and the Augusta Civic Center was restored Friday too, hours before the first show of a planned three-day run of the Kora Shrine Circus at the Civic Center. Officials had anticipated they’d have to sell tickets only for cash at the event.

“We are taking credit cards as we speak at the Civic Center and Hatch Hill,” Ralph St. Pierre, finance director and assistant city manager, said Friday afternoon. “The circus is in town, so I’m sure people will appreciate that.”

Fred Kahl, director of information technology for the city and schools, said the piece of malware — software that can include viruses, worms, ransomware and other things meant to cause damage to a computer or network — was found in about 12 city computers or other devices, and in 10 servers. He said the servers were undamaged and work was underway to get everything working again.

St. Pierre said the staff and a consulting firm working on the problem haven’t had time to investigate what may have caused the problem, because they’ve been working to solve it and restore the system. He said Friday afternoon there was still a lot of work to be done to restore internet service so that City Center can reopen Monday.

Kahl said the freeze-up of the computer network was caused by “a piece of malware that had a bad attitude.” He said it appears it was a targeted attack. But he also said no data, such as personal information about residents, was taken in the incident. Kahl said they may never know exactly how the attack occurred.

“We’re only sure it was a vindictive piece of malware,” said Kahl, who expects to work through the weekend, with other IT staff. “We’re looking into how it got in. Obviously we don’t want to do this again.”

Mills said the federal Department of Homeland Security and the FBI have been notified of the attack. He said such attacks occur every day across the country.

The city did not make a ransom payment, as some Maine municipalities and even the Lincoln County Sheriff’s Office have done previously, to have the software removed.

School Department computers and servers, which have a connection to the city network, were not affected by the cyberattack, as they were shut off from the network to protect them, before the malware spread.

St. Pierre said it is not yet known how much money the attack cost the city to fight off. He said no equipment was damaged, so the additional cost would be for overtime for city staff and the cost of hiring consultants, from Systems Engineering of Portland, to help solve the problem.

While City Center will reopen Monday, things there still won’t be back up to full speed then. A vendor needed to restore the city’s financial systems won’t be in Augusta to work on the system until Monday morning.

St. Pierre said city staff members would be able to provide some services as they normally would and also help residents obtain other services, such as vehicle registrations and dog licenses, online by going to state websites, but only if the residents can pay by debit or credit card.

He said they should be able to do vehicle registration renewals online using debit or credit cards, but they won’t be able to do new vehicle registrations until the work requiring the vendor is complete.

“We’re at the mercy of the third-party vendor coming in,” St. Pierre said. “They’ve got us scheduled to do the restoration starting at 8 a.m. Monday.”

He said hopefully things will return to normal at City Center by Monday afternoon or Tuesday.

« Previous

Maine goes into a wet weekend with a flood watch

Next »

Lewiston lawmakers say they’re focused on ‘pocketbook issues’