City says about 25,000 notification letters sent after October data breach; network rebuild to be phased

City staff told the Board of Mayor and Aldermen on July 2 that the city is continuing a phased response to a cybersecurity incident discovered in October and that roughly 25,000 notification letters were mailed in the latest round.

"In total this last week a little over 25,000 letters were sent," Bruce, a city staff member overseeing notifications, told the board, saying there are three letter versions depending on what information was exposed. He said round one focused mainly on employees; round two expanded to water customers and other records; a third round of letters is under way.

Andrew, another staff member working on the response, said the city is using IDX to recover and analyze data that appeared on the dark web and to provide fraud‑protection services to people whose information was exposed. "The evaluation of the data continues," Andrew said, adding that IDX is obtaining files from the dark web and returning them for analysis.

City officials said some residents received letters addressed to maiden names or the names of minors because those records came from insurance or legacy documents. Staff also said some exposed files included bank account numbers and other sensitive information: "There's a letter that deals with that," Bruce said of bank‑account exposures, and the city is advising affected people to follow instructions in the mailed notice and to contact their bank if instructed.

Officials said the city's cyber insurance policy covers up to $250,000 and that the city may approach that limit depending on how many residents sign up for IDX services. "We are quickly approaching that limit," Bruce said, and added that the city may need to return to the board to allocate additional funds if insurance proceeds are exhausted.

Glenn, the city's IT lead, described a phased rebuild of network infrastructure rather than simply restoring the old systems. He said design work is already under way with Waypoint and Mission Critical for segmented networks (police, library and other critical functions) and that equipment lead times and supply‑chain issues for memory and servers remain a constraint. Staff estimated a full rebuild could extend toward the end of the year, but emphasized the work will be phased so essential services come back online sooner.

When asked about legal liability for people who may have been affected but not yet notified, board members were told the question should be addressed by the city attorney; staff affirmed they are making best efforts to locate correct addresses and to log returned mail as part of the notification requirement.

The board was urged to direct residents who receive notices to use the phone number on the letter and the IDX portal for next steps; staff said the city has posted explanatory material on its website and is sharing updates on the city social media channels.

Next steps reported to the board included continuing the IDX data analysis, completing the third round of letters as files are confirmed, tracking cyber‑rebuild expenses under a special budget code, and returning to the board with cost estimates as the rebuild progresses.