BELLA VISTA – The cyber attack on the city in August resulted in expenses totaling more than $132,000, but the city’s cyber insurance policy through the Arkansas Municipal League is expected to cover nearly half of that amount.

The Bella Vista City Council on Monday approved 5-0 a resolution to add $132,849 to the information technology budget to cover costs. Councilman James Wozniak was absent.

The total cost is a combination of expenses, Information Technology Director John Moeckel told the council during an Oct. 21 work session. Those expenses include the cost of work done in the immediate response to the cyberattack and the cost of corrective actions and improvements made to the city’s computer systems to make them more secure, he said.

The overall price reflects the forensic investigation the department needed to complete, as well as recovery help and specialized technical support provided by outside sources, Moeckel said.

“We had some issues getting our court system back online and we had to contact the vendor that provides our court system and we had some billable hours there,” he told the council, which received details about the costs in meeting documents during the meeting. work session.

Employee overtime expenses were separated in the meeting documents because they are billed separately to the insurance company, Moeckel said.

“The rest of the items after overtime are improvements that we believe will improve our safety here and help maintain our facilities,” he added.

Moeckel said the department expects insurance to reimburse $65,820 of that amount. He has been in contact with the Municipal League’s IT director, Jeff Melton, who has been “a great resource throughout the entire process,” Moeckel said.

Moeckel is confident the cyber insurance policy will reimburse the city’s expenses related to investigation, recovery and support, excluding employee overtime, he told the council.

It’s good news that a new Cyber ​​Response Board has been created at the state level, Moeckel added.

The Arkansas Cyber ​​Response Board was formed under Act 846 of 2023 to administer the Arkansas Self-Funded Cyber ​​Response Program to provide coverage for cybersecurity incidents, risks, damages or losses caused by a cyber attack on an entity participating government, according to the governor’s office.

Melton plans to advocate for the city during the November board meeting, Moeckel said.

“He thinks he can get overtime paid from a fund that we contribute to,” she said.

Councilman Jerry Snow asked during the Oct. 21 meeting about the company hired to monitor the city’s computer systems 24 hours a day and whether its services were effective during the attack.

“In this case they were a real lifesaver,” Moeckel said. “They called me at home and alerted me that something strange was happening. They took containment actions and things like that, so yes, they were a huge benefit.”

Snow also asked about the origin of the attack and how it came to be that the city endured such an event. Moeckel said the full investigation report is still being drafted, but council members would be welcome to attend a briefing once it is completed. He said these types of attacks are sophisticated and he did not want to discuss specific details during a public meeting.

According to a city news release on Aug. 26, the day before city offices and the library reopened to the public after being closed for six business days, the cities of Springdale, Fayetteville, Fort Smith and Siloam Springs, along with Benton and Washington counties sent IT workers to Bella Vista to assist in the recovery process.

While offices reopened, some systems were still under repair, including those at the District Court. However, the city did not have to pay any ransom and there was no breach of personal information, according to the statement.

All network systems in the city were shut down on August 19 after the attack was identified the night before. Offices closed and city employees worked remotely as best they could all week.

The police and fire response was not disrupted as those departments operate in a separate, unaffected system, according to the statement.

The city’s network shutdown came three weeks after Northwest Arkansas Community College suffered a cyberattack, causing its network to shut down. The start of classes for the fall semester was postponed by a week as a result of the incident.