SOUTHWICK – Town officials are asking residents who have signed up for CodeRED emergency notifications to change their passwords after the system was the target of a cyberattack.
“We didn’t lose any of our ability to contact our residents,” said Fire Department Chief Richard Stefanowicz about the service being hacked last week.
CodeRED is a cloud-based platform used by city, county, and state agencies to send emergency alerts via voice calls, SMS, email, mobile app notifications and national alerting systems.
During the attack, multiple media sources reported that data was stolen, including names, addresses, email addresses, phone numbers and passwords.
Stefanowicz said that only those residents who have accounts with CodeRED, or used the CodeRED application, should change their passwords.
He said there are some people who created CodeRED accounts to keep up-to-date with emergency notifications in nearby cities and towns.
However, for residents who signed up for texts, which most residents are, there is no action needed at this time, he said.
The town maintains the capability of sending out messages and will partner with Massachusetts Emergency Management Agency should it need additional support for any emergency messaging, according to a statement on the town’s website.
If you think you have been the victim of a data breach, cybersecurity experts recommend these steps to protect yourself:
- Check the vendor’s advice. Every breach is different, so check with the vendor to find out what’s happened and follow any specific advice it offers.
- Change your password. You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
- Enable two-factor authentication (2FA). If you can, use a FIDO2-compliant hardware key, laptop, or phone as your second factor. Some forms of 2FA can be phished just as easily as a password, but 2FA that relies on a FIDO2 device can’t be phished.
- Watch out for impersonators. The thieves may contact you posing as the breached platform. Check the official website to see if it’s contacting victims and verify the identity of anyone who contacts you using a different communication channel.
- Take your time. Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
- Consider not storing your card details. It’s definitely more convenient to let sites remember your card details, but we highly recommend not storing that information on websites.
- Set up identity monitoring, which alerts you if your personal information is found being traded illegally online and helps you recover after.
