The City of Princeton has confirmed that confidential and personally identifiable information was taken from its computer systems during a cybersecurity incident that first came to light in September.
City officials announced Monday that an ongoing forensic investigation determined data was exfiltrated from city systems on October 5. The update marks a significant shift from earlier statements in which officials said there was no evidence that personal information had been compromised.
Princeton said it is working with cybersecurity professionals to determine the full scope of the breach including exactly what data was taken and how many residents may be affected. The city acknowledged that its continuing investigation has uncovered additional information requiring further review.
A ransomware group previously claimed responsibility for the attack and stated it had obtained nearly two gigabytes of data from the city’s internal file server. Cybersecurity experts who reviewed the group’s claims said the stolen data allegedly included residential addresses, financial accounts, court records and forensic copies.
The city has not yet confirmed which specific categories of information were definitively compromised or provided an estimate of how many individuals may be impacted. Princeton officials said they will notify affected residents in accordance with state law once the review is complete.
The city added that it plans to offer impacted individuals access to identity protection and credit monitoring services. Essential city services have continued to operate normally throughout the investigation.