The Alert Long Beach system, used to warn residents of natural disasters, dangerous weather and other emergencies, has remained offline for nearly a month, following a cyberattack that placed data of the system’s 25,000 local users at risk.
In a phone call Tuesday, city officials confirmed they shut down the system on Nov. 11, immediately after they were notified by its operator, Crisis24, that data may have been compromised.
The breach was confirmed in a second notice to the city 10 days later, on Nov. 21. Information at risk includes home addresses, phone numbers, email addresses and passwords used to make profiles.
This breach affected Crisis24’s system, called OnSolve CodeRED, nationwide. The company did not disclose the exact scale. It is used by more than 10,000 cities, towns, villages, counties and local governments across the United States and Canada, according to their website.
In its notice to Long Beach, the company said it was likely caused by “a targeted attack by an organized cybercriminal group.”
Underscoring the seriousness of the attack, the company said an investigation is underway.
“While there is currently no indication that this data has been published online, we are proactively informing you that it may be leaked,” the company said in the notice.
The data does not include financial data, Social Security numbers or other “sensitive information.”
Of the 25,000 accounts citywide, 9,000 used an optional password. Reggie Harrison, director of the city’s Disaster Preparedness & Emergency Communications, warned that anyone who used a password that is similar or the same as other accounts should have them changed.
The alert system, he added, will remain offline as the city decides whether to stick with Crisis24 or choose a new operator. The city has used this system for about 10 years.
It was instrumental during the coronavirus pandemic, used to keep residents abreast of the most recent state health orders. Until it was taken offline, Long Beach continued to use it to warn residents by phone call, text or email of inclement weather, unsafe air quality and evacuation or shelter-in-place orders.
“Going forward, whether we work with CodeRED or some other information provider, our goal is to find the most secure system for public information that we possibly can,” Harrison said.
In the interim, Long Beach residents will continue to receive alerts through the federal Wireless Emergency Alerts. Notices can also come from helicopter announcements, police and firefighter sirens, social media, and door-to-door warnings, according to Harrison.
“We are not totally dependent on Alert Long Beach to get messages out to residents,” he said.