PERAC Memo #18 - 2025: Cyber Attack
Cyber Attack
View original on mass.gov →Summary
PERAC reports that a retirement board suffered a ransomware attack by an unauthorized third party who encrypted network files; fortunately, no funds were lost and no data was misused. The board's preparedness — including offsite backups, a disaster recovery plan, cyber insurance, and immediate engagement of legal counsel, law enforcement, IT providers, and PERAC — enabled a swift and organized response. PERAC urges all boards to ensure data backups, review business continuity plans, assess cyber insurance coverage, and maintain accessible emergency contact information.
Full Text
Memorandum Memorandum PERAC Memo #18: Cyber Attack Date: 06/26/2025 Referenced Sources: PERAC Website PERAC Memo #18, 2025
To All Retirement Boards: TO: All Retirement Boards
FROM: Bill Keefe, Executive Director
RE: Cyber Attack
DATE: June 26, 2025
Please be aware that a retirement board’s IT network was accessed by an unauthorized third party. The unauthorized third party then placed ransomware to encrypt and to prevent access to network files. It is not clear yet when the unauthorized third party accessed the network before launching the attack nor how access was made, though similar attacks have used phishing and malicious links.
Fortunately, as of this writing, no funds are missing and there are no reports of misuse of any personal or sensitive data. The investigation is ongoing.
Also fortunately, the board had taken a number of steps to prepare for this scenario and then took immediate action when it happened.
The board had backups of its data and files offsite in the cloud. The board has a disaster recovery plan and put it into action. There is no threat to the monthly payroll being generated. The board has a cyber insurance policy and immediately contacted the carrier. The board immediately contacted its IT provider and attorney, and together with the cyber insurance carrier, they have developed an action plan and are executing it. The board also immediately contacted law enforcement, investment professionals, financial institutions, its pension software vendor and the state’s Executive Office of Technology Services and Security (EOTSS). The board immediately contacted PERAC so that we can assist where possible and disseminate information to put other boards on alert. Boards should work to ensure that their data and files are backed up. Review disaster recovery and business continuity plans and if those plans aren’t in place, strongly consider developing them. Make sure important contact information is readily accessible. The slides PERAC distributed on March 25 from the cybersecurity webinar have a list of who to contact in a cyber emergency in the EOTSS attachment. Additionally, the full package of those slides contains other resources and valuable information. Assess the board’s cyber insurance status. Boards with insurance should review their policy and ensure it is current and sufficient. Boards without insurance should discuss coverage with their municipality or IT provider and board counsel. PERAC is working on holding a cyber insurance webinar in late summer.
IT professionals often say it’s not a matter of if an organization will get hacked, but when. The best we can do is to take proactive steps to prevent attacks as well as to take preparations to act in the event of an attack and to mitigate its effects.
Should you have IT-related concerns or questions, please contact PERAC IT Director Dan Boyle at daniel.m.boyle2@mass.gov or 617-591-8902.