A cyberattack shut down Andover's municipal and school computer networks for four days this month, delaying teacher assignments to families just before the school year and cutting off online bill payments, Town Manager Andrew Flanagan confirmed Saturday, Aug. 22.

The attack, first detected Thursday, Aug. 13, is the second cybersecurity incident to hit Andover in less than a year. An investigation into whether any town or school data was accessed or stolen remains open.

Flanagan's confirmation, sent by email nine days after the outage began, was the first time officials publicly acknowledged a cyberattack. On Aug. 13, the town had described the disruption only as a "temporary issue impacting internet connectivity" that could affect residents' ability to reach employees by email.

What happened

The town responded by taking external email offline, activating its cyber incident response protocols and bringing in outside cybersecurity professionals, according to Andover News. Town buildings stayed open, phones kept working and public safety systems were not interrupted.

By Monday, Aug. 17, most systems were back online, though some residents still had trouble making online payments.

Flanagan did not identify who carried out the attack, how they gained access or whether ransomware was involved.

"The Town was well prepared to respond to an event of this nature," Flanagan said in his email. "That preparation allowed the organization to act quickly while maintaining continuity of public services."

Data breach question unanswered

Whether attackers accessed, copied or compromised any town or school data remains unclear. Flanagan said the town is working with cybersecurity and legal professionals and following all applicable notification requirements.

Second incident in a year

The attack follows a separate breach less than a year earlier involving CodeRED, the third-party emergency notification system Andover uses. In that case, the town later said compromised information was limited to deactivated passwords last used before 2015 and did not include names, addresses or other personal data. That breach occurred within CodeRED's platform, not Andover's own network.

This time, the attack hit Andover's infrastructure directly.

No Select Board meeting or public hearing on the cyberattack has been announced.