Personal information ‘likely stolen’ in Kings County cyberattack

An Annapolis Valley, N.S., municipality is working to get systems back to normal after a cybersecurity incident in July may have affected hundreds of people’s personal information.

Staff at the Municipality of the County of Kings said they brought in experts to go over what happened July 10-11, and now believe the initial attack happened through exploiting a software vulnerability on one of their servers.

Greg Barr, county finance and IT director, said in a news release that sensitive personal information of municipal employees and councillors was “likely stolen,” while other organizations receiving pension-related services from Kings were also affected.

“We have reached out to all those individuals that were impacted from this and provided them information and support and resources, and next steps,” said Barr.

Notices have been issued to 456 people, although the majority are out of an abundance of caution, he said.

Public asked to ‘be vigilant’

But beyond those people, Barr said it’s possible anyone who has corresponded with the municipality had their name and email accessed as well.

“We’re going to encourage everyone to be vigilant about any emails or phone calls they may receive that might be appearing to be on behalf of the municipality,” Barr said.

Anyone who gets communication from the County of Kings requesting personal information or payment is asked to call the municipality directly to make sure it’s legitimate.

 Kings said no payment card information was affected.

Barr said in the days following the incident, they took down their website, internet and all systems. Since then, Barr said they have worked with experts to address issues and strengthen their security.

The majority of municipal services and the website are back online, but Barr said they still have work to do.

While Barr said the municipality cannot share more publicly about the incident itself due to safety concerns, the incident has been reported to the RCMP, Nova Scotia’s privacy commissioner, and the Canadian Centre for Cyber Security.

The municipality said anyone who believes they’ve been the victim of identity theft, or their information has been misused in a fraudulent manner, should call the RCMP. People can also look into credit monitoring and identity theft protection services, and monitor their financial statements.