The city of Dothan is consulting legal and forensic firms to determine if litigation against the company behind its utility payment processor is necessary after a recent cybersecurity attack.
City commissioners recently obtained the legal services of the law firm of Mullen Coughlin, LLC in Pennsylvania to assist the city in determining if a breach of user data took place, and if necessary, engage in litigation on the city’s behalf — something Mayor Mark Saliba said was “imminently likely.”
The law firm has considerable experience in investigating and litigating alleged cybercrimes.
An executive session was held after Monday’s commission meeting to discuss actions moving forward after approving services with an expert computer-forensics consulting firm, Charles River Associates, for a fixed fee of $45,000.
“That will get us started down the path determining, No. 1, if a breach did occur,” City Manager Kevin Cowper said. “If it did occur, to what degree? How many people are impacted by that? What is the process we need to take next to notify those individuals and to take other remedial actions such as credit monitoring, things of that nature?”
CentralSquare, the company owning the online utility payment system Click2Gov, said it has insufficient evidence to determine whether a breach of user data took place, according to Cowper.
The city’s cyber insurance will cover the cost of the attack event, subject to a $25,000 deductible.
The attack was discovered by city officials after a customer reported his or her data was compromised shortly after using the site, said Dothan IT Director Jack Mason. City officials contacted CentralSquare about the issue the next day, and CentralSquare admitted that some attacks may have occurred.
CentralSquare conducted an analysis of the Dothan systems and reported a data breach to the city after business hours Nov. 6. With the Veterans Day holiday approaching, city officials — including legal counsel — could not schedule a conference call to discuss the scope of the breach and corrective actions until Nov. 12.
The city announced the breach that day, and on Nov. 13, officials learned the attack affected eight other cities.
Officials plan to switch to another payment system provider by the end of January as a part of Dothan Utilities’ new smart-metering system now being installed.