Who is a member?
Our members are the local governments of Massachusetts and their elected and appointed leadership.
The cybersecurity landscape continues to evolve. While ransomware remains a major concern, attackers are changing how they access systems and disrupt operations as systems and services become more interconnected.
In a recent report, the MassCyberCenter and the Massachusetts Office of Consumer Affairs and Business Regulation analyzed 2,164 data breaches reported across the Commonwealth in 2024. Of the incidents with enough information to identify a threat, system intrusion was the most common, followed by internet-facing vulnerabilities. Human negligence, third-party vulnerabilities, identity-based attacks, and social engineering also contributed to the breaches.
Recent incidents show how quickly a cyber event can become an operational issue. In early September, the Springfield Public Schools closed for several days after an outside group gained access to the district’s network and blocked access to online programs needed for school operations. One affected system contained student medical records, leaving school nurses unable to access information needed to dispense medications and reliably address allergies.
That same week, the city of Everett temporarily closed City Hall after a cybersecurity incident affected its internal network. Essential municipal services continued from another location while the city worked to restore systems safely.
Changing attack paths
Recent incidents show how the access methods used by attackers on municipal systems are changing. A successful attack does not have to begin with a highly technical breach. Stolen credentials, a convincing phishing email, an unpatched system, or access through a third-party vendor can all provide an entry point.
Artificial intelligence can make some of these tactics more expedient and convincing. Cybercriminals can use AI to produce more-credible phishing messages, imitate voices or tone, and gather information about potential targets more quickly. At the same time, organizations using AI tools need to consider what data employees share with them, what systems the tools can access, and how their use is governed.
While AI can make existing cyberthreats faster and more sophisticated, many of the same cybersecurity practices remain essential. In a recent presentation to MIIA leaders and members, Tokio Marine HCC, MIIA’s cyber partner, characterized AI as an accelerant of existing risks – an approach reflected in MIIA’s cybersecurity guidance.
Cities, towns and municipal entities also face risks through the cloud services and outside technology providers they use. These services support municipal functions such as payroll, financial systems, emergency notifications, records management, and other essential functions. If a shared provider is compromised or becomes unavailable, the impact can extend beyond a single user or organization.
A nationwide cyberattack on the third-party CodeRED emergency notification system in late 2025 affected communities across Massachusetts and the country, disrupting access to a service many use to communicate emergency information to residents, and illustrating the ripple effect of one incident. The attack occurred within CodeRED’s systems rather than individual municipal networks, but it affected many communities at once.
Five questions for cyber resilience
Drawing on guidance from Tokio Marine, MIIA advises that municipal leaders strengthen cyber resilience by looking beyond individual technology products and asking whether critical safeguards are in place, working and regularly tested.
Five questions can help guide those conversations:
1. Are critical accounts and identities protected? Multifactor authentication and other access controls should cover email, remote access, administrator accounts, and other critical accounts, with identified gaps or exceptions addressed.
2. Can critical services be restored quickly enough? It’s not enough to simply have backups. Municipalities should know the backups are protected, available, and regularly tested, and should have a plan for which services to restore first, such as financial, public safety, or other essential systems.
3. Which third parties could disrupt municipal operations? Identify critical vendors and cloud services, understand what systems or data they can access, and consider fallback options if a provider becomes unavailable.
4. How are AI tools approved and monitored? Municipalities should know which tools employees may use, what sensitive information they can enter, what systems or data they can access, and where human oversight is required.
5. Are incident response and financial verification procedures tested? Municipalities should practice incident response plans, and use a known, separate communication channel to verify requests involving payments, payroll, or changes to banking information before acting.
Resources for the public sector
Building cyber resilience requires a layered approach. The MassCyberCenter report recommends stronger passwords, multifactor authentication, employee education and training, improved threat monitoring, updated firewalls, and replacing legacy technology.
Many of these services are offered through organizations including:
• The Commonwealth Fusion Center’s Massachusetts Cybersecurity Program, which conducts threat reporting, training, education, and awareness related to cybersecurity.
• The Office of Municipal and School Technology in the Executive Office of Technology Services and Security procures and manages the free Cybersecurity Awareness Program.
• CyberTrust Massachusetts, a membership-based nonprofit organization, provides cybersecurity education and services.
• The cybersecurity firm KnowBe4 offers materials free of charge to public sector organizations.
• MIIA also offers cyber security training to its members.
Regularly reviewing safeguards, identifying new dependencies, frequent employee training, and testing response and recovery plans can help municipalities strengthen resilience over time.
MIIA members can access additional cybersecurity guidance and may also be eligible for funding for cyber risk prevention initiatives through the fiscal 2027 Risk Management Grant Program.
Written by Jennifer Ranz