Cyber attack update: Middletown residents can pay water bills starting in December

A 25% additional charge will be added to “cover a portion of service charges from the past several months when billing systems were down.”

Vice Mayor Steve West said on Facebook that any payments already made by residents during the outage will be applied to the December bill.

“Some residents have interpreted the 25% as an added fee, rather than part of the standard billing calculation, so we want to ensure this is communicated clearly moving forward,” he wrote.

He added the 25 percent is not a service fee. Instead, it “goes toward the previous months of usage” as not to give people multiple months of usage in one bill.

Trash and stormwater flat fees will be back-billed in full and will return to normal in January.

For 2026 bills, the city hopes to resume meter readings and traditional billing but cannot provide an exact timeline, according to the release. Billing based on estimated usage will continue until that time.

When meter readings and traditional billing resumes, exact amounts owed by residents for usage during the billing outage will be determined, and any additional amounts owed will be spread over the following six billing cycles to “minimize challenges for residents.”

The city will also resume shutoffs for accounts that were delinquent prior to the cybersecurity attack; these shutoffs were paused during the billing outage.

A separate notice will be sent to delinquent accounts with details on how to avoid shutoff, according to the release.

No details were released on what information, if any, was accessed. There was also no update on the status of fingerprint-based criminal background checks.

Tuesday, the city elected to enter into contracts with a cybersecurity company for “network restoration, ongoing threat monitoring, incident response readiness and system hardening.”

Based on these contracts and money spent in October on cyber efforts, the city has voted to spend $1,029,410 on cyber-related contracts, restoration and equipment.

Additional documentation on money spent because of the cybersecurity incident was requested via a public records request by Journal-News but has not been received.

A $250,000 contract was entered into Tuesday with Moraine-based SecureCyber “on an as needed basis.”

A master services agreement was also entered for ongoing threat monitoring, incident response readiness and system hardening. This agreement for August through December 2025 totals $79,400. For 2026 and 2027, the contract totals $202,200 per year.

The amount totaling $733,800 will come from the general fund ($250,000) and the computer replacement fund ($79,400).

In 2026 and 2027, the amount of $202,200 will be included in the annual budget for each year from the computer replacement fund.

In a staff report, Troy Anderton, information systems director, described the efforts as “essential to restoring operations and protecting our restored network.”