Swampscott still has not said whether information was accessed in network disruption

← All news · August 29, 2026

Nine days after a network disruption canceled a Select Board meeting and pushed Town Hall's records onto phone photos of a corkboard, Town Administrator Nick Connors gave the town's first on-the-record spoken account on Aug. 27: roughly fifty seconds, with no cause, no affected-systems list, no restoration date, no vendor, and no statement about data. No board member asked a question about the incident.

Swampscott still has not said whether any resident or employee information was accessed in the network disruption that has hobbled Town Hall for nearly two weeks.

Town Administrator Nick Connors gave the town’s first spoken account of the incident at the top of the Select Board’s Aug. 27 meeting. It lasted about fifty seconds. He described a “network disruption that has impacted some aspects of our operations,” said the town was “very close to full restoration,” and said the town was investigating “with the assistance of specialists.” He added: “As the investigation into this matter is ongoing, we can’t provide too many further details at this time.”

No board member asked him a question about it, not after the report and not once across the four hours that followed. The town’s whole spoken account of an incident that canceled a meeting and took its records systems dark is that one passage.

The meeting was the rescheduled version of the Aug. 18 Select Board session the disruption canceled the day it was set. Nine days passed between the disruption, which Connors has dated to Aug. 18, and his account. In that time, the town posted a three-sentence written notice, its online meeting record froze, and Town Hall fell back on phone photographs of paper agendas pinned to the corkboard outside the Town Clerk’s office (Aug. 25 coverage).

No Statement on Data

Connors’s statement made three claims: the town is “very close to full restoration,” it is running “an investigation with the assistance of specialists to determine the nature and extent of the issues,” and it “can’t provide too many further details at this time” while that investigation remains open. He thanked residents and staff for their patience.

Set against the town’s Aug. 19 written notice, only the progress claim was new. The notice already said the town “immediately took steps to secure our network” and brought in “third-party specialists to investigate the full nature and scope of the incident and securely restore files and systems.” Connors restated that account and added that recovery is nearly done.

Neither the notice nor the statement gives residents the basic facts they would need to gauge exposure: cause, affected systems, a restoration date, a vendor, or any statement about data. The town has not said whether any resident or employee information was accessed. It has not used the words “cyberattack,” “ransomware,” or “breach.” Its language, including “secure our network,” “the nature and extent,” and “specialists,” matches the measured register of incident response or insurance. That describes the words, not what happened.

The town’s September newsletter, published during the incident, does not mention the disruption.

The Board Asked No Questions

The town’s live stream of the Aug. 27 meeting stopped mid-sentence roughly an hour and forty minutes in, during the police presentations. The next afternoon, a complete recording, four hours and eight minutes long, went up in its place. The meeting record is now whole. The account of the incident inside it still runs about a minute.

Around that minute, the board handled a bond note, the town’s year-end finances and an overlay error behind a six-figure deficit, a parking-enforcement overhaul, elementary-school traffic, the Lynnway corridor, a possible charter commission, and trash service. Board members pressed staff for twenty minutes on notice to abutters along an overgrown rail trail. On the incident that had darkened the town’s records systems and canceled this meeting, the record shows no question from any member.

Connors describes his own role as execution, not policy: “we’re here to execute, we’re not here to dictate.” Chair Katie Phelan sets the agenda. The record does not show why the board did not ask about the disruption. It shows that the questions were not asked.

Notice Duty Depends on Data

Two Massachusetts laws set the floor for what the town must say and what it may withhold.

The first is the state data-breach statute, M.G.L. c. 93H. Municipalities are covered: the law defines “agency” to include “any political subdivision.” Its notice duty (§ 3) triggers when the agency “knows or has reason to know of a breach of security,” or that personal information “was acquired or used by an unauthorized person.” “Personal information” (§ 1) means a resident’s name together with at least one of a Social Security number, a driver’s-license or state-ID number, or a financial-account or card number.

When the trigger fires, the town must notify three audiences: the Attorney General, the director of the Office of Consumer Affairs and Business Regulation, and each affected resident. The notice must go out “as soon as practicable and without unreasonable delay.” The clock “shall not be delayed” merely because the total number of affected residents is not yet known. The notice to residents may not state the nature of the breach or the number affected.

A network disruption, by itself, does not trigger that duty. The trigger is a determination that personal information was acquired or used. Nothing in the public record shows the town has made that determination, or has knowledge that would require it. The Office of Consumer Affairs’ public breach list carried no Swampscott entry through filings reported Aug. 20. That is consistent with no determination, a pending determination, or a reporting lag; it is not evidence either way.

The town may hold internal knowledge that is not public. On the public record, the notice duty has not been shown to have fired. A finding that resident or employee personal information was accessed would change that and would require deadlined notice to the Attorney General, the state consumer-affairs office, and every affected resident.

Records Exemption Is Conditional

The second law governs what the town may withhold. Connors’s statement that the town “can’t provide too many further details” tracks the public-records exemption for cybersecurity records, M.G.L. c. 4, § 7, cl. 26(n).

That shield is conditional. It reaches security and cybersecurity records only when disclosure, “in the reasonable judgment of the record custodian, subject to review by the supervisor of public records,” is “likely to jeopardize public safety or cyber security.” A parallel exemption, clause (f), covers investigatory materials whose release “would probably so prejudice the possibility of effective law enforcement.”

Both exemptions are bounded and reviewable. A resident can file a records request and, if the town refuses it, appeal to the Supervisor of Records, who tests the custodian’s judgment. The ongoing-investigation posture rests on a real legal basis, but not a blanket one.

No Cause or Timeline Yet

The town has committed to two things: restoration is nearly complete, and an investigation is under way. It has not committed to a cause, a timeline, or any statement about data.

A determination that personal information was accessed or acquired would move the town from a silence it may keep to a disclosure it must make, on a deadline, to the Attorney General, the state consumer-affairs office, and every affected resident. Short of that, the open questions are the ones a records request exists to test. The OCABR list is current only through Aug. 20, and “very close to full restoration” is the town’s word, with the SCTV video portal still dark, as it has been since Aug. 19.

Sources