Ordinance to allow up to $500,000 for Cape Girardeau cyberattack costs

At the Cape Girardeau City Council meeting Monday, councilmembers heard first, second and third readings of and passed an ordinance that would declare the January cyberattack on the city as an emergency.

The ordinance would authorize city manager Scott Meyer to access funds for operating and capital expenditures in response to the cyberattack of up to $500,000 from the city’s Emergency Reserve Fund for “any costs that are not recovered through the City’s insurance for recovery, remediation and future mitigation,” according to an agenda report attributed to city finance director Victor Brownlees.

“Insurance mitigated the financial impact of a cyber-attack that rendered some computer systems and files inaccessible,” the agenda report stated. “Access to Emergency Reserve Funds could enhance recovery and resiliency.”

Brownlee’s report stated the City of Cape Girardeau “lost access to data and various computer systems” on Jan. 18 and “according to a forensic audit, no customer, resident, or employee information was taken.”

An FBI investigation into the attack is ongoing, and city officials were reportedly advised not to disclose the complete nature of the attack until the investigation is completed and the affected systems and data are fully restored.

The financial impact of the cyberattack was also mentioned in the report, which stated the city purchased “cyber insurance” in September with “the maximum coverage available of $2 million with a standard deductible of $25,000.”

According to the report, the direct costs associated with the attack should be met by the city’s insurance provider with the exception of the cost of the deductible.

The ordinance would require the city manager to report the disbursement of any funds used.

Many of the city’s affected systems have been restored since the attack, including city email and online utility bill pay. Other services remain offline, including the city’s GIS mapping systems and some city-maintained web applications.