Andover confirms its August attacker got inside town systems

"The Town has identified unauthorized access to certain systems and is continuing to determine the nature, scope, and sensitivity of any data that may have been accessed or acquired," Chief Communications Officer Phil Geoffroy said in written answers to Andover News ^[5]. He said some of the material reviewed so far appears routine or publicly available, but the full data set has not been characterized ^[6]. Investigators still have to check any accessed data for personally identifiable information ^[9].

That check decides whether the state breach law, Chapter 93H, applies. If it does, the town has to notify the people affected, as well as the Attorney General's Office and state regulators ^[17]. On Sept. 28, Town Counsel Doug Heim told the Select Board it was unclear whether state-protected information was involved ^[11].

Access is the only confirmed fact. Thecyberexpress.com described the confirmation as the town's clearest admission that the Aug. 13 attack reached its systems, though not proof that anything was copied, removed or published ^[7]. The same report says the WallStreet listing proves neither that the group was responsible nor that data was stolen ^[15]. Geoffroy would not name the agencies the town has notified. "The Town is coordinating with appropriate legal, forensic, and governmental partners as required and cannot comment on any law enforcement-related aspects of the event at this time," he said ^[16].

The response contract allowed for contact with the attacker. Vector3's agreement set aside up to $3,000 for possible communication with the attacker and for monitoring negotiation channels for up to 60 days. Whether that provision was used is unconfirmed ^[14]. The town's cyber policy carries $100,000 of cyber-extortion coverage ^[3].

On cost, Geoffroy said the insurer pays the contractors directly ^[1]. "Subject to the limits of our policy, Andover will bear no additional costs for these contractors and bills will be paid by our insurer," he said ^[2]. The policy covers up to $1 million across several categories of cyber expense ^[3].

Containment came first. Officials secured and restored the network, then reconnected equipment across municipal and school offices, printers included ^[10]. The municipal and school network was disrupted for four days. VPN access stayed down while it was rebuilt, and shared drives were not fully back until Aug. 21 ^[20], eight days after the attack ^[22]. Public safety, municipal buildings, phones and town-operated utilities kept operating ^[20]. "Based on what is currently known, the Town does not believe this incident reflects a lack of investment in information technology or incident preparedness," Geoffroy said ^[19].