A year later, Newfound school district still recovering from cyber attack

BRISTOL — A full year after a cyber attack on Nov. 20, 2023 left employees of School Administrative Unit 4 and the Newfound Area School District without access to their computers, the business office is still working to rebuild the financial records necessary to file reports with the state to allow the Department of Revenue Administration to set property tax rates for the seven member towns.

Superintendent Paul Hoiriis said the Department of Education extended its deadline for filing required reports until Nov. 30, but the district was not able to meet that extension. A new deadline has not yet been set.

“That is not our intent, as we want to meet our deadline so that the towns can get their tax bills out as soon as possible,” Hoiriis said.

Even meeting the Nov. 30 deadline would have delayed the mailing of property tax bills well into December, giving residents until January to make their tax payments. Holding off until January, however, would mean those who itemize their income taxes would not be able to claim those payments for the 2024 tax year.

Primex, the insurance pool which serves schools and municipalities, hired the Seacoast cyber security company Atom Group to help the district recover its files, also providing funds to hire temporary staff to assist in re-entering the missing information into the computer system. Business administrator Angela Carpenter told the Newfound school board on Nov. 25 some were working extra hours, unpaid, to complete the rebuild.

“I appreciate the hard work from my team,” she said, “and, you know, it’s starting to come together. We’ve got a good team and good people and very dedicated.”

Carpenter said while the team continues working on rebuilding financial records, she will be moving on to the coming year’s budget, which normally gets underway much earlier. The administration prepares a draft budget for consideration by the school board and the district budget committee.

Hoiriis and Carpenter shared good news about a payroll audit by Municipal Resources, Inc. After the hack, the finance staff manually calculated last year’s payroll, which involved matching wages with the terms of teacher contracts and collective bargaining agreements.

“The audit was not a legal requirement, but something we wanted to do to make sure everything was done correctly and to give our employees peace of mind,” Hoiriis explained. “It is also our intent to correct any mistakes. Fortunately, very few were found, and will be addressed immediately.”

Reading from the audit report, Carpenter said, “Sad to say, although accurate payroll processing is critical to every organization, payroll mistakes can be made and do happen.”

MRI’s report continued, “Of the 121 teacher payrolls reviewed, which encompassed approximately 1,900 individual ‘pays’, MRI consultants found that three (3) teachers had payment discrepancies during the period reviewed, and three (3) teachers had contracts where we could not fully match wages to the contracts provided.”

The company concluded, “Based on the information provided to us by the District, we believe that under the circumstances, the unintentional errors that MRI has identified fall at or below the number of errors that we typically see in public sector payroll processing.”

Hoiriis told the school board, “What this audit really said — and I just want to give credit to the folks at the SAU in accounts payable and payroll who did keep track of it — they’re saying that the errors that they saw were the same or less than someone who didn’t have a cyber attack. So I definitely have to hand it to those folks who worked really hard in piecing together a system until we’re up and running.”

The school board also discussed a citizen’s request to post the monthly financial manifests — documents providing comprehensive details of all payments — on the school website or with documents provided with board agendas.

When Aubrey Freedman of Bridgewater made the request on Nov. 12, board members pointed out that citizens always have the right to inspect the manifests by stopping by the SAU office. Freedman maintained some people find it difficult to go to the office during business hours, and making documents widely available would provide more transparency into where taxpayer money is going.

Francine Wendelboe, the board member from New Hampton, asked that the request be placed on the Nov. 25 agenda for further discussion.

Vice Chair Kimberly Bliss of Alexandria said she checked with surrounding towns to determine whether they post such information on their websites, and found only one municipality that published some detailed data online.

“Anything else that you wanted, you’d have to go to Town Hall and pick it up and look at it,” Bliss said.

Wendelboe responded by asking why Newfound could not be the first to offer that information online. “In this day and age, why should people have to go to Town Hall and take up people’s time and so on, especially when you’ve got seven/four towns in a district, spread out over miles? I don’t see any downside to it.”

Bliss brought up a more serious problem with sharing manifests: Some of them have included identifying information that could run counter to confidentiality laws. The board got into an extended discussion about students being identified by name on some pages.

While the public has been able to see those documents by visiting the SAU office, Hoiriis said later that, whenever a member of the public asks to examine documents, they ensure no confidential information is revealed.

“Any information protected by FERPA or other confidentiality laws would be redacted,” he said.

The board agreed that, in the future, such identifying information should not be included on manifests, but otherwise found nothing wrong with sharing the documents online. Hoiriis said he would bring a recommendation back for the board’s consideration on Monday, Dec. 16.

“I am working with our team to come up with a publishable report that could possibly be included in distributed public materials for board meetings or simply published on our website that would be transparent to the public while safeguarding personal information,” he said the following day.