The city of Winston-Salem experienced a network security breach last month. Here’s what we know so far. 

Featured photo: City Manager Pat Pate responds to questions from the media in city hall on Friday, Jan. 17. (Photo by Gale Melcher)

This is a developing story.

As residents of Winston-Salem celebrated the holidays with family and friends, the city experienced some technical difficulties that prevented many from paying bills or requesting services.

On Dec. 30, the city released a statement that a “cyber event” occurred on Dec. 26, which means that some online services have been unavailable after the city took certain computer systems offline out of an “abundance of caution,” according to the Dec. 30 press release. 

An “unauthorized actor” accessed an “encryption of certain systems on the city’s networks,” City Manager Pat Pate explained to reporters at city hall on Jan. 17. For cautionary purposes, they decided to completely disconnect certain city software computer systems from the internet to prevent “any continued incursion into our systems,” Pate explained.

While they don’t know exactly when the intrusion occurred, Pate confirmed that Dec. 26 was the day that they noticed unauthorized “activity” on the city’s network.

And ever since the intrusion was detected, it’s been all hands on deck. 

Pate said that they’re receiving help from federal, state and local agencies such as the NC National Guard, NC Local Government Information Systems Association’s Strike Team, the NC Department of Emergency Management — and even the FBI, the Secret Service and the Cybersecurity and Infrastructure Security Agency.

But the city has kept relatively mum on what exactly happened.

What’s going on right now?

According to the city, it has not been confirmed if any personal information has been impacted by the cyber attack. Pate said that the city will communicate with “affected parties” if any information has been accessed.

“We are not aware of any identity theft or fraud as a result of this incident,” Pate noted.

Pate also noted that because there’s an ongoing investigation, they can’t release a lot of details, including whether the intruder was a group or an individual. 

The city manager said that in order to follow state law, no contact “has been made or will be made with the responsible actors in this event.”

According to state law, no state or local government agencies are allowed to “submit payment or otherwise communicate with an entity that has engaged in a cybersecurity incident on an information technology system by encrypting data and then subsequently offering to decrypt that data in exchange for a ransom payment.”

Pate said that because there has been “no contact” with the unauthorized actor, there has been “no demand for anything.”

But some progress has been made, he explained.

“All of our major systems actually are operational and have been rebuilt,” Pate said. However, the city is making sure that systems are “completely safe” before they turn everything back on.

What services have been impacted?

The city’s website has been operational this whole time, Pate said. But there are some services that are still unavailable, including the city’s online utility bill service. For now, residents have to go to Bryce A. Stuart Municipal Building at 101 E. First St. with cash or a check to pay their bills. And if anyone is worried about paying their bill and being able to prove whether they paid, Pate said that they can collect a receipt when they pay in person.

Pate said that “at this point,” the city isn’t adding any late fees or turning off services on people who were typically paying their bills online and are not able to do so at this time.

And the city will notify the public when systems and services are brought back online, Pate said.

On Jan. 21, the city announced that CityLink phone service would be restored at 7 a.m. on Jan. 22. This allows residents to report issues or request services. However, CityLink still won’t be able to accept payments for water, parking tickets or yard carts, or initiate requests to start or stop utility services.

The city’s police, fire and utilities departments are conducting “business as usual” and are not impacted, according to Pate.

Since the incident, the city has issued more than 1,100 permits, Pate noted, and they’ve completed 2,500 inspections.

The most difficult thing has been “routing around things that have to have multiple signatures” or going old-school on formerly automated processes — city staff are having to remember how they did things “for decades in the past,” he said.

The broader context

The city isn’t alone in cyber disruption issues. In December, Winston-Salem/Forsyth County Schools, as well as Guilford County Schools, were impacted by a data breach of PowerSchool, an information management platform used by many school systems nationwide. But the incidents are unrelated and the city hasn’t been impacted by the PowerSchool breach, Pate said.

When asked about how much it’s costing the city to investigate and rebuild their systems, Pate responded that they don’t have any “specific information now” regarding the cost of this event. But the city has cybersecurity insurance that will help cover some or all of the expenses.

For now, the city is working to “restore the network,” Pate said. But they don’t want to rush their recovery efforts. They’re reviewing and evaluating all of their security tools and processes as well as product protocols to “ensure that the public is protected,” he noted.

And Pate added that while the city can’t guarantee that this will never happen again, they’ve “taken all precautions.” City systems have been “completely rebuilt and upgraded,” he noted. “This puts us in a better place moving forward.”

“We believe our system is probably the safest local government network in the United States at this point in time,” Pate said.

• Share this article: