Cyber attackers who locked up Petersburg borough computers in July demanded about $1 million in Bitcoin, and the borough refused to pay, Borough Manager Stephen Giesbrecht told the Pilot last week.

“We got a ransomware notice from an outside bad guy, basically saying if we wanted our computers to work again, we should pay them,” Giesbrecht said. “We’re not going to pay ransomware.”

The borough disclosed the July 11 attack in a public notice issued Oct. 16, more than three months later. Giesbrecht said outside experts told the borough to stay quiet until they could confirm the attackers were no longer inside its network.

The forensic investigation wrapped up in mid-October and found no personal data was stolen, the manager said. The borough posted its notice shortly after.

“No public employees. None of that was out in the open. It was all protected,” Giesbrecht said.

The attack hit on a weekend and locked a large part of the borough’s network, he said. Because the borough backs up its systems daily, it had copies through the previous Friday. “We didn’t lose anything.”

The borough notified the Alaska Department of Public Safety, the FBI, Department of Homeland Security and the municipality’s insurer. Its IT contractor, Professional Computer Solutions, brought in its own network security specialists, and the insurer’s experts also took part.

Investigators traced the attack to Eastern Europe but did not determine how the attackers got in or which computer was hit first, Giesbrecht said. The investigation concluded that the attackers got in, locked up the systems and left. The review also included checking whether borough data had surfaced on the dark web.

Giesbrecht said the computers that were hit were running an older version of the borough’s security software. Machines with the newer version were not breached.

“The older version didn’t stop these guys from getting in, and those were the computers that got hit, including mine,” he said. Every borough computer has since been updated.

The municipality’s public notice said the utility billing software was affected and that customer names and utility account numbers were accessible. However, it says customers’ credit card and banking information is not stored on the network and was not exposed.

Giesbrecht said the borough keeps only the last four digits of Social Security numbers in its system, and credit card payments pass to an outside vendor without being stored. Viewing a full utility account requires a password that is not kept on the network, according to the notice.

For weeks, staff were told to stay off borough email and anything connected to the network, communicating by text message instead, in case the attackers were still watching, Giesbrecht said. He said it was highly disruptive. His own computer was down for two weeks.

Employees were told individually, according to the notice. The borough “was advised to limit public disclosure of the incident in case those responsible for the ransomware attack were still monitoring the borough,” the notice said.

Giesbrecht acknowledged the length of time between the incident and the public notification. “When the pros tell us don’t talk about it, don’t release information, don’t get on email, that’s exactly what we [did].”

He said the briefing assembly members received in executive session Oct. 20 was the first time everyone heard the full account.

Recovery cost the borough roughly $130,000 to $140,000, not counting staff time, the manager said. The borough’s cyber insurance deductible is $75,000, and the insurer has paid back about $50,000.

Giesbrecht credited Devren Bennett and the crew of Homeport Electronics in Petersburg, whose staff wiped each affected computer and readied it before specialists arrived in town to restore systems from backups.

“I know that sounds like a long time, but it couldn’t have happened even that quickly without Devren and his staff,” the manager said. “It was a huge help.”

All borough employees now must use multi-factor authentication and long passwords, and quarterly anti-phishing training is mandatory.

In June 2025, scammers posing as planning and zoning officials emailed official-looking invoices seeking nearly $5,000 from at least two people with applications pending before the Petersburg planning commission. The scammers’ intended victims both recognized the scam. The borough has since changed how it handles applicant information, Giesbrecht said.

The FBI warned in March that similar schemes impersonating local planning officials have targeted permit applicants nationwide.

“Will we ever get hit again? Yeah, probably,” Giesbrecht said. “Even though you do all the right things, sometimes the bad guys can get in.”

Giesbrecht compared Petersburg’s experience to the Matanuska-Susitna Borough, which was hit by ransomware in July 2018. The attack knocked out its email, phones and hundreds of computers, sent employees back to typewriters and led the borough to declare a disaster. Mat-Su also refused to pay the ransom.