City Hall only open to employees Thursday and Friday due to ongoing 'cyber incident'

After reopening City Hall on Wednesday, the city ran into technical challenges, resulting in officials reclosing it to the public, the city said Wednesday afternoon.

On Thursday and Friday, the building will only be open to employees, and city services will be unavailable at City Hall, the city said.

Late Wednesday morning, the city reopened City Hall after a two-day closure because of the cyber incident, and it said it was important to have staff in the building Wednesday so it could fully understand what systems were working, test applications and determine what systems need further diagnosis, the city said.

However, the city said it has contained the threat and is working on restoring the systems and opening services back up to the public.

"We deeply apologize for the inconvenience and are working to resolve this issue," the city said in a statement.

The city encourages residents to use online services or to call 311 for more information.

We've reached out to the city about how long it will take to restore all services, but the city hasn't provided that information— stating that the incident is still under investigation.

News 5's Sarah Buduson was at City Hall this morning when its doors reopened.

Residents react

We spoke to Larry Doss, who went to City Hall prior to the building's reopening Wednesday at 11 a.m. He was there to incorporate his new trucking company.

"It's just the time we live in. It's sad. We should hope that our government state and federal offices protect us, but you know, I feel like it's almost impossible to completely guard us against that," Doss said.

Another local resident, Laron Fields, wanted to get a copy of his birth certificate to secure a new apartment. The closure this week delayed him getting a new place to live.

"I mean, all of our personal information is only in this one building, so if it's not open, it's like we shut down the world," he said. "I don't want to believe it, but it seems like that is the world we live in."

A former Cleveland resident named Sarah, who didn't want to use her last name, who now lives in Nashville went to City Hall to get a copy of her goddaughter's birth certificate.

"Just don't open it until it's up and running because then people are coming down here wasting time," she said.

What happened?

The city made the public aware of a cyber incident on Sunday after discovering "abnormalities" on Saturday.

Cleveland city officials declined to provide much information about the nature of the incident during a news conference on Monday afternoon, citing the need to protect their ongoing investigation into the matter.

RELATED: Cleveland City Hall reopening Wednesday following mysterious 'cyber incident'

Cleveland Mayor Justin Bibb said the closure was a precaution while the incident is being investigated. As of Monday afternoon, phone service had been restored, and crews were working to restore access to several key city IT systems.

Emergency services such as 911, police, fire and EMS, along with Cleveland Hopkins International Airport and Burke Lakefront Airport, were not affected, officials said. Additionally, the Department of Public Utilities was also not affected, nor was certain city data, such as resident tax information and customer information."

Cleveland Commissioner of IT Kim Roy Wilson said the city took precautionary measures to contain what she called "abnormalities." The nature and scope of these abnormalities are under investigation.

Without getting specific, Bibb compared what's happening here to incidents that have occurred in other large cities, large companies and major hospital systems.

What is a cyberattack?

Across the nation, cyberattacks on public entities are becoming a trend; McDonald Hopkins, a business advisory and corporate law firm, said in 2023, they saw several hundred cyber security incidents.

“Threat actors have started to realize that they have sensitive data, they have employee personal information, they have resident data, utility payments, bank account information, credit card information, and so there is value to that in the threat actors, if not just for them to use and misuse that data, but to actually extort the municipality the entity with that data,” said Dominic Paluzzi member and co-chair of the Data Privacy and Cybersecurity practice at McDonald Hopkins.

They said cyber events occur when an unknown party shows suspicious activity that can cause an interruption within the system. Adding it doesn't always mean a data breach, but when it happens, it's important to disconnect all systems and then investigate.

“To actually figure out how they got in, and what they did when they were in there can take several weeks up to several months,” said Dominic.

If the municipality has proper server backups, restoration can take days to weeks, but if they don't, it could take months. Cleveland officials haven't given any update on that investigation or a timeline.