Virg Bernero: Cyberattack galvanizes BWL, Lansing

LANSING - Mayor Virg Bernero expressed confidence Thursday that the Lansing Board of Water & Light is in good hands under General Manager Dick Peffley as the city-owned utility tries to recover this week from a cyberattack of its computer network.

Bernero, who is in Italy, issued a statement to the Lansing State Journal commending Peffley for acting as "swiftly as possible" to make sure customer data stayed secure and electric, water and steam services were never disrupted.

"At a time when cyberattacks are constantly evolving and becoming more sophisticated, we know there is no such thing as perfect security," Bernero said. "So we must be ever vigilant and continuously improve our security systems."

Peffley held a news conference at the utility's customer service center on Haco Drive on Thursday to assure customers that their billing information is secure and that they can manage their accounts as they always have. BWL should have most of its business functions restored soon, he said.

"I think this company is going to be in very good shape by Monday," Peffley said. "We're hoping to get credit card payments (at the counter) up by tomorrow."

As of Thursday afternoon, customers still couldn't use credit cards at the service counter, although cards could be used at the automated kiosks, he said.

"You can pay your bills at the counter, get your service turned on, turned off," he said. "You can pay at our kiosks. You can do e-billings."

The utility shut down its accounting and email systems after an employee unknowingly opened an email with a malware-infected attachment at about 5 a.m. Monday.

The attack also forced BWL to shut down phone lines, including a customer assistance line often used for account inquiries. Power and water shutoffs are suspended until further notice. The customer service line was being tested on Thursday and may be operational on Friday, Peffley said. In the meantime, customers can use the "877" after-hours number to reach the utility, he said.

Customer billing information and employee data were not compromised, and the utility's production facilities also were unaffected, he said.

"The firewalls worked as designed," he said.

State, local and federal agencies are investigating the cyberattack, Peffley said. He said it involved malware that "locked us out of our system" but declined to say if the virus is a form of Ransomware, in which the creators provide a remedy in exchange for payment.

Peffley said BWL had up-to-date antivirus software from one of the 50 companies specializing in it. But officials realized this week that only three of those companies can handle the new virus. The utility has since received necessary protection from one of those three companies, he said.

Lansing Police Chief Mike Yankowski wrote in an email Thursday the attack is being investigated by the Michigan State Police and Federal Bureau of Investigation. He declined further comment, saying Lansing is not the lead agency.

Jill Washburn, an FBI spokesperson in Detroit, declined this week to explain the agency’s role. Messages left this week with State Police investigators weren’t returned.

Chad Gamble, Lansing’s chief operating officer and public service director, wrote in an email Wednesday that information technology systems in other city departments have been “very successful” in protecting the city from large-scale cyberattacks and aren’t affected by the breach.

Bernero left Saturday for a trade mission in Italy with staff from the Lansing Economic Area Partnership and is expected to be back in Lansing next week. Randy Hannan, Bernero's executive assistant, wrote in an email that Bernero and his wife, Teri Bernero, are staying longer in Italy at their own expense.

Bernero said BWL and the city will work together "even more closely" to ensure the highest possible level of network security throughout city government and its agencies. He added the city will work with state and federal law enforcement to identify and prosecute "those who perpetrated this unconscionable attack."

Contact Eric Lacy at (517) 377-1206 or elacy@lsj.com. Follow him on Twitter @EricLacy. Contact Ken Palmer at (517) 377-1032 or kpalmer@lsj.com. Follow him on Twitter @KBPalm_lsj.