Princeton Cyber Scare Deepens As City Says Breach Claims Still Aren’t Verified

Princeton’s cybersecurity scare is still unfolding, but city officials say the most alarming claims circulating online have yet to be backed up by evidence.

Cybersecurity concerns dominated portions of the September 21 City Council meeting after residents pressed officials for answers about reports that city information had been compromised. The meeting also included an emergency executive session involving what the agenda described as an active cybersecurity incident affecting critical information technology and communication systems.

One resident questioned how much city information may have been exposed and whether Princeton remained at risk. "Everybody’s anxious here about how it happened, why it happened," the resident told council. "Are we still at risk? What are we doing forward?"

City officials pushed back on treating the online allegations as confirmed. One council member said that, as of the meeting, "there has been no evidence that anything posted online is actually accurate" regarding claims of a breach.

Another council member urged residents to wait for verified findings rather than rely on information circulating online. "If we don’t have any information to provide, then there’s nothing for us to speak on," the council member said, adding that releasing unverified information would amount to speculation.

That message became more concrete one day later. In a September 22 update, the city said two independent cybersecurity reviews had been completed and neither found evidence of unauthorized access to city systems, a confirmed data breach or unauthorized data being taken from the city.

The city cautioned that the investigation is not finished. Officials said another independent cybersecurity firm is being brought in to conduct a more comprehensive forensic review while the city continues coordinating with cybersecurity professionals, governmental partners and law enforcement.

The investigation follows an online ransomware claim involving Princeton. The group behind that claim alleged it had obtained city information, but the claim itself has not been independently verified. Princeton has said it will rely on its investigation rather than claims made by outside parties when determining what happened.

Residents at the September 21 meeting repeatedly returned to the question of what information, if any, was exposed. One speaker said the possibility of sensitive information being involved was creating anxiety in the community, while another urged the city to make sure reporting deadlines and forensic procedures were followed if a breach is ultimately confirmed.

Council members also emphasized that cybersecurity professionals were already working behind the scenes. "Let the professionals do the job that they need to do to protect us," one council member said. "We want to make sure the information we provide to everybody is accurate information."

Princeton’s original September 18 notice said the city was investigating potential unauthorized access to certain systems and data and working to determine whether any information had been accessed, acquired or otherwise affected.

Four days later, the city’s position was more encouraging but still cautious: two reviews had found no evidence confirming a breach, while another forensic review was being ordered before the city closes the book on what happened.