Andover probes data theft after August breach; systems restored but scope of exposure unknown
Town leaders admit attackers entered certain networks in August but have not yet determined if sensitive data was exfiltrated.
Key points
- Andover confirmed unauthorized access to some systems following an August 13 cyberattack.
- Officials have not yet determined the scope or sensitivity of potentially accessed data.
- Network restoration is complete, but the investigation into data exposure continues.
Andover town officials confirmed that an attacker gained unauthorized access to certain computer systems during a cyberattack that occurred on August 13. Chief Communications Officer Phil Geoffroy made this admission in written responses to Andover News, marking the clearest indication yet that the breach reached municipal infrastructure.
Geoffroy stated that the town is actively determining the nature, scope, and sensitivity of any data that may have been accessed or acquired. While some reviewed materials appear to be routine or publicly available, the full dataset remains uncharacterized. Officials cannot yet confirm whether any information was copied, removed, or published by the intruder.
Investigation Status and Network Recovery
The town has completed the initial phase of securing and restoring its network infrastructure. This effort involved reconnecting equipment across municipal and school offices, including peripherals such as printers. Despite these operational restorations, the investigation into the data breach remains ongoing.
Geoffroy did not specify which systems were compromised or clarify whether the affected networks belonged to the municipality or Andover Public Schools. He also declined to provide a completion date for the investigation. Town Counsel Doug Heim is involved in the proceedings, though specific legal details were not disclosed in the initial update.
Data Sensitivity and Next Steps
Investigators are currently checking any accessed data for personally identifiable information to assess potential risks to residents and employees. The town has not released a timeline for further updates, stating only that additional information will be provided when appropriate.
The lack of specific details regarding the systems involved suggests the scope of the breach is still being mapped. Officials emphasized that while some data appears benign, the full extent of the exposure is not yet known. This uncertainty prevents them from confirming whether sensitive records were compromised.
What should you do?
Residents and employees who interact with Andover municipal services should monitor their personal accounts for unusual activity. Since the town has not confirmed if personally identifiable information was accessed, vigilance is prudent. Users should review bank statements and credit reports for signs of fraud.
What to do and how to stay safe: Andover
- Monitor financial accounts and credit reports for unauthorized transactions or inquiries.
- Enable multi-factor authentication on all personal accounts linked to municipal services.
- Watch for phishing emails that may reference this incident to steal credentials.
- Keep personal software and devices updated to reduce exposure to common exploits.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did Andover confirm that data was stolen in the August cyberattack?
No, officials confirmed unauthorized access but have not yet determined if data was copied or acquired.
Which systems were compromised in the Andover cyberattack?
Officials have not identified the specific systems or whether they belonged to the town or schools.
Has Andover restored its network operations after the breach?
Yes, the town has secured and restored its network, reconnecting equipment across municipal and school offices.
