‘Bad guys are always going to find a way’: Oxford County employee data may have been breached in cyber attack

Oxford County officials are speaking publicly regarding a cyber attack on the municipality's IT systems. CTV London’s Bryan Bicknell reports.

Oxford County now says it has reason to believe the personal information of thousands of current and former employees may have been breached in a cyber attack earlier this month.

“I’m very sorry. I’m sorry to staff that may have had their information compromised,” said Oxford County Warden Marcus Ryan, speaking publicly for the first time about the IT incident since it was first revealed Sept. 15.

“Unfortunately, it’s somewhat a reality of 2024, 2025, 2026, that this is going to happen. IT experts all have been telling us for years these things are going to happen, you need to prepare. Thankfully, we were in the process of preparing. You can never be prepared enough. Bad guys are always going to find a way,” he exclaimed.

The county says it’s using third-party cybersecurity experts in its forensic investigation and to contain the breach.

Just how deep the information breach goes is not known, according to Ryan. But as many as 4,000 people may be affected, including 1,000 current and another 3,000 former employees.

There are many more questions the county cannot answer publicly for fear of tipping off the cyber-criminals. For instance, who’s responsible, how it happened, and whether ransom has been asked for.

Independent IT expert Carmi Levy, who is not involved in the county’s response, says right now a great deal is at stake for those affected.

“Much of this information is personal, private, financial, it is incredibly damaging if it falls into the wrong hands. And now, now that it’s been weaponized, it’s out there. It will be used in ways like this indefinitely. The risk doesn’t just go away because the headlines fade. These thousands of current and former employees are going to now face this risk for literally the rest of their lives,” said Levy.

Levy advises employees to take full advantage of credit monitoring and identity protection services offered by the county.

In the meantime, Ryan can’t say what the county’s response to the cyber attack is costing ratepayers, except that so far, it’s within an allocated budget for emergency responses.

“But we will be managing this on an ongoing basis for months, because once someone has gained access, whatever it is, you’re continually evaluating then, ‘What did they get access to?’” said Ryan.