INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Andover Confirms Cyberattack Reached Its Systems

| 2026-10-09 06:12 CRITICAL HIGH DATA BREACH
JSON
Executive Summary
AI-generated
An attacker gained unauthorized access to some of Andover's computer systems in August, with the Town confirming the incident on October 9. The WallStreet ransomware group listed Andover as a purported victim on a dark-web site on August 30, but neither proves responsibility nor data theft. The affected entity is Andover Public Schools and municipal offices, which were impacted by over 3,000 devices. The attack works by exploiting vulnerabilities in the systems, allowing the attacker to access certain areas without taking any confirmed data. As of October 9, the Town continues its investigation into the nature, scope, and sensitivity of accessed or acquired data, with officials stating that some reviewed material appears routine or publicly available but the full data set remains uncharacterized.
Technical Mitigations AI-generated
• Review and monitor devices for unauthorized access, tracing the attacker's activity. • Check accessed data for personally identifiable information to determine potential sensitivity. • Block or hunt for indicators of ransomware groups listed on dark-web sites.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope governmentgovernment financefinance
Incident Timeline
‎Aug. 13
The Town of Andover confirmed that a cyberattack occurred on August 13, but did not provide evidence of data copying, removal, or publication.
organisation Brooks, Smith & Prophete
Investigators and Ransom Questions   The Town hired law firm Constangy, Brooks, Smith & Prophete and cybersecurity firm Vector3 on the evening of Aug. 13.
‎Aug. 21
Shared drives returned fully on August 21, while VPN access remained down during its rebuild following a confirmed cyberattack.
‎Aug. 30
WallStreet, a ransomware group, listed Andover as a purported victim on a dark-web site.
tactic Ransomware
On Aug. 30, a ransomware group called WallStreet listed Andover as a purported victim on a dark-web site, which proves neither responsibility nor data theft.
organisation WallStreet
On Aug. 30, a ransomware group called WallStreet listed Andover as a purported victim on a dark-web site, which proves neither responsibility nor data theft.
‎Sept. 22
The Andover office received no notice of the cyberattack as of September 22.
‎Sept. 28
The Select Board confirmed on September 28 that a cyberattack had reached its systems, with the extent of state-protected information involvement still unclear.
organisation the Select Board
Town Counsel Doug Heim told the Select Board Sept. 28 that it was unclear whether state-protected information was involved.
‎Oct. 5
The Town of Andover received no bills and incurred no costs beyond its insurance policy on October 5, contradicting agreements estimating at least $39,605 in initial work.
organisation Town
An Oct. 5 public records appeal response said the Town had received no bills and incurred no costs beyond its insurance policy, seemingly conflicting with agreements estimating at least $39,605 in initial Vector3 and Constangy work.
financial $39,605 agreements
An Oct. 5 public records appeal response said the Town had received no bills and incurred no costs beyond its insurance policy, seemingly conflicting with agreements estimating at least $39,605 in initial Vector3 and Constangy work.
‎2026/10/09
Andover Public Schools and the Town of Andover confirmed a cyberattack on their systems, with Vector3 tracing the attacker's activity to assess data access or removal.
financial $1 policy
The policy covers up to $1 million for several categories of cyber expenses and $100,000 for cyber-extortion, with a $10,000 retention on most categories.
financial $100,000 expenses
The policy covers up to $1 million for several categories of cyber expenses and $100,000 for cyber-extortion, with a $10,000 retention on most categories.
financial $10,000 $ retention
The policy covers up to $1 million for several categories of cyber expenses and $100,000 for cyber-extortion, with a $10,000 retention on most categories.
organisation Andover News
“The Town has identified unauthorized access to certain systems and is continuing to determine the nature, scope, and sensitivity of any data that may have been accessed or acquired,” Chief Communications Officer Phil Geoffroy said in written answers to Andover News .
organisation Andover Public Schools
Geoffroy did not identify the systems, say whether they belonged to the municipality or Andover Public Schools, or give a completion date.
organisation Geoffroy
On ransom demands or negotiations, Geoffroy said only that the Town “did not make or authorize any payments in connection with this incident.”
financial $3,000 agreement
Vector3’s agreement allowed up to $3,000 for possible communication with the attacker and monitoring of negotiation channels for up to 60 days, though its use is unconfirmed.
organisation General’s Office
If Chapter 93H, the Massachusetts breach law, applies, the Town must notify the Attorney General’s Office, state regulators and affected people.
infrastructure 3,000 devices
Vector3 is tracing how the attacker entered, reconstructing the attacker’s activity, assessing whether data was accessed or removed, and helping monitor more than 3,000 devices.
Tactical Metrics
Metrics
financial
1,000,000
Financial Impact / Stolen Funds
The policy covers up to $1 million for several categories of cyber expenses and $100,000 for cyber-extortion, with a $10,000 retention on most categories.
Metrics
financial
100,000,000,000
Financial Impact / Stolen Funds
The policy covers up to $1 million for several categories of cyber expenses and $100,000 for cyber-extortion, with a $10,000 retention on most categories.
Metrics
financial
10,000
$ Retention
The policy covers up to $1 million for several categories of cyber expenses and $100,000 for cyber-extortion, with a $10,000 retention on most categories.
Metrics
financial
3,000
Financial Impact / Stolen Funds
Vector3’s agreement allowed up to $3,000 for possible communication with the attacker and monitoring of negotiation channels for up to 60 days, though its use is unconfirmed.
Metrics
financial
39,605
Financial Impact / Stolen Funds
An Oct. 5 public records appeal response said the Town had received no bills and incurred no costs beyond its insurance policy, seemingly conflicting with agreements estimating at least $39,605 in initial Vector3 and Constangy work.
Metrics
infrastructure
3,000
Devices
Vector3 is tracing how the attacker entered, reconstructing the attacker’s activity, assessing whether data was accessed or removed, and helping monitor more than 3,000 devices.
Intelligence Sources
The Cyber Express 2026-10-09