Huber Heights’ IT director resigned 9 days before cyber attack

Council satisfied to reaction following Sunday’s cyber attack on city data systems.

Members of Huber Heights City Council said Wednesday their unanimous vote to declare the city under a state of emergency following a cyber ransomware attack earlier this week was fueled by a desire to get the situation under control as quickly as possible.

A state of emergency was first declared by City Manager Rick Dzik, according to a resolution presented during Monday’s city council meeting which was unanimously affirmed by all members on council.

The resolution grants the city manager authority and discretion to spend up to $350,000 in response to the cyber ransomware attack, which city officials said was first discovered Sunday.

“We need to get this fixed and get information as quick as possible and the city manager needs to be able to do his job,” said Councilwoman Anita Kitchen of her decision to affirm the state of emergency and pass the resolution. “I want to make sure that whatever response is needed, there are funds in line and the ability to do what needs to be done on a timely basis.”

The city’s charter stipulates when a state of emergency can be implemented. This includes after “a disaster affecting life and property and which substantially impairs the functioning of the city government and its ability to protect the lives and property of the people.”

The charter amendment does not specifically outline restricted or permitted uses of city funds under such an emergency.

The vote to approve the resolution was held Monday following an executive session discussion of “details of security arrangements and emergency response protocols for a public body or public office if disclosure of the matters discussed could reasonably be expected to jeopardize the security of the public body or public office.”

Councilman Richard Shaw said he feels confident in how the city is handling the issue.

“We got the call from the mayor to come in for an emergency meeting and I’ve got to applaud the staff and council because once we got the call, a meeting was held within 25 minutes,” he said, adding that he feels Monday’s vote shows a sense of urgency on behalf of city leaders. “I think it can assure residents that the city has taken this seriously, and that we’re streamlining the process to get things done quickly, but thoroughly at the same time.”

Councilman Ed Lyons said he was immediately concerned upon hearing about the attack, especially in light of the recent resignation of the city’s information technology lead Branden Payton, who resigned on Nov. 3, just over a week before the cyber attack.

“My first thought was that it is not a good time to not have an IT director,” Lyons said Wednesday.

Payton was employed by the city in several IT positions since April 7, 2003. He submitted a letter of resignation on Oct. 16, a copy of which was requested from the city by this newspaper late Wednesday afternoon. Lyons said members of council were told Payton had taken a new job out of the city.

The ransomware attack has locked city employees out of the systems they use to keep track of data. The city is working to restore the data from backups and perform a forensic analysis on the computers, a process which Dzik said is being handled off-site by a third-party vendor and a forensic investigation firm.

As of Wednesday afternoon, Dzik said officials are still not sure if any city data has been taken to be held for ransom or if any resident information is affected by the attack.

“As we’ve been telling the public, if any resident is affected, we will notify them and go through whatever processes are needed to (rectify the situation),” he said.

According to Dzik, Cloud-based city services have resumed, including functions like zoning, permitting and code enforcement. But services where data is stored in on-site servers, like those within the billing and finance department, will take longer to recover.

“Our hope is by the end of this week or early next week, we have most of our services back up and running,” Dzik said, noting that the investigation itself may take multiple weeks or a month to complete.

For now, city staff are using newly purchased devices, including laptops, that have never been connected to the now-compromised network. While this makes daily tasks more difficult, Dzik said employees are temporarily shifting focus.

“Not being able to use your normal technologies is a game-changer in terms of doing your job, but city staff is working on backlog projects that they can do without technology,” he said. “We’re finding workarounds to get the job done and make sure we’re still working for the city.”

About the Author