City of Princeton Confirms Data Exfiltration Following Cybersecurity Incident

The city of Princeton has confirmed that confidential and personally identifiable information was taken from municipal systems during a cybersecurity incident first disclosed in September.

The city said Oct. 5 that its continuing forensic investigation determined information had been exfiltrated from city systems. Princeton is working with cybersecurity professionals to determine what information was involved and which individuals may have been affected. Once that review is complete, the city said it will notify affected individuals as required by law and provide identity protection and credit monitoring resources. Essential city services have continued to operate normally.

Princeton initially disclosed the incident Sept. 18, saying it was investigating potential unauthorized access to certain city systems and data. The city, including the Princeton Police Department and other departments, took steps to secure affected systems and began working with IT staff, outside cybersecurity specialists and law enforcement partners. At the time, officials said they had not yet determined whether information had been accessed or acquired.

The incident prompted the City Council to add an emergency item to its Sept. 21 meeting. A supplemental notice described an active cybersecurity incident affecting critical city IT and communications systems and said council action could include emergency contracts, expenditures, professional services and remediation measures. The council also scheduled an executive-session discussion involving response and recovery measures intended to protect public safety, critical infrastructure and government operations.

On Sept. 22, Princeton said two independent cybersecurity reviews had found no evidence at that time of unauthorized access, a confirmed data breach or data exfiltration. The city then brought in another cybersecurity firm for a more extensive forensic review, which later determined that information had been exfiltrated from city systems.

Princeton has not publicly identified the affected systems, the types of personally identifiable information taken, the number of individuals affected or how the intrusion occurred. The city also has not disclosed the cybersecurity firms involved in the investigation or any contracts or expenditures tied to the response. Its Oct. 5 notice said the investigation remains ongoing and that additional information will be released as appropriate.