Lessons Learned from Curry County Cybersecurity Incident

Presenter: Ted Fitzgerald
Room: Crater Lake North, EMU 146, Level 1
Presentation: Curry County cybersecurity event and experiences
Time: 03:00p – 03:30p

On April 26, 2023 I was made aware of a ransomware attack on the County IT infrastructure by representatives of the County’s third-party IT services consultant.  I immediately contacted the County’s insurer, CIS, and asked for direction. CIS referred the County to a law firm that, in coordination with a technology consultant, would serve as our “Breach Coach.” I was provided with a scope of services that could be used in our situation and was made aware of the minimal coverage limits available under our cyber-security policy. As our County had very limited cybersecurity protections in place at the time of our most recent policy renewal, the insurance protection available to us was almost non-existent. The predicted cost of services to be provided by the Breach Coach dwarfed our insurance limits. During my presentation, I will discuss the steps taken by the County subsequent to the attack, and the measures implemented to ensure cybersecurity protections moving forward.