Hacker breaks into Henderson computer server

A computer hacker broke into a city of Henderson Web server and had access to data for nine days before being detected, officials said this week.

The city said no personal or sensitive information was compromised, with the hacker only being able to see the raw versions of public data that are already searchable through Web forms.

But the highly unusual breach led the city to spend $40,000 on a consultant to make sure the intruder hadn't gained broader access to government systems. It also launched a law-enforcement investigation that's still pending.

"This is the first time since I've been here, and the first time I'm aware of, that we actually have somebody who got this far," said Laura Fucci, the city's chief information officer, who has been with Henderson since late 2012.

The city made no public announcement of the breach and discussed it in response to inquiries from the Review-Journal.

Fucci said the hack was detected June 29 when a system administrator noticed errors in a "tool" that monitors anonymous activity. Realizing there had been an intrusion, the administrator disabled the server, and the city started trying to determine how far the hacker had gotten.

The city also notified what a spokesman called the "appropriate federal authorities" — a likely reference to the FBI, which routinely investigates computer hacks since many originate from overseas.

FBI spokeswoman Bridget Pappas in Las Vegas declined to confirm or deny an investigation.

All Henderson employees were told to change their passwords, which Fucci called a standard response to any computer system breach.

Fucci declined to discuss how the attacker gained access beyond saying "hacking tools" were used. She said the city quickly decided to hire an outside company to investigate the breach and make sure it had been contained.

Within a few days, the city had signed a $40,000 contract with a company specializing in "incident response." Fucci declined to name the company, citing a nondisclosure agreement.

The hacker had gotten access to a server that held data on city detention center inmates and people who registered as volunteers. It also hosted Legitrack, an internal system used by employees to track bills at the Nevada Legislature.

"What we were concerned about is, did they get beyond that? Did they get into our internal network?" Fucci said. "And they did not get into our internal network."

The contractor analyzed city systems and saw no evidence the hacker had gained access to any other servers, Fucci said.

The intrusion has kept the tool that allows people to search for inmates in the city detention center offline for more than six weeks. Fucci said the city wants an outside security review to make sure it's safe before it goes back online.

The webpage does not tell viewers it is down because of a hack, but simply says: "Inmate Information is temporarily unavailable at this time. We apologize for any inconvenience and appreciate your patience. Please call 702-267-JAIL (5245) for more information."

While nine days sounds like a long time for an intrusion to go undetected, Fucci said it's short in computer security terms. She pointed to a report from security consultant Mandian that found the median time before a hack is detected is 205 days, or almost seven months.

Fucci said she expects the city to learn lessons from the hack that will make its systems safer.

Contact Eric Hartley at ehartley@reviewjournal.com or 702-550-9229. Find him on Twitter: @ethartley.