Cambridge Public Safety Agencies Issue CodeRed Emergency Notification System Update; Users Should Reset Passwords

The following is an update on the OnSolve CodeRED emergency notifications system.

The City of Cambridge and thousands of other local government and public safety agencies across the country use the voluntary subscription program. Also referred to as Cambridge's reverse 911 system, CodeRED is where residents can sign up to receive notifications and emergency alerts affecting the City, such as snow emergencies, evacuations, large-scale water outages or other significant service disruptions. The system makes robocalls or sends texts or emails with important information. The platform was taken offline in November following a nationwide cyberattack.

After receiving additional information this week, the City wanted to share the latest details with residents and steps that all users can take going forward.

Note: To continue receiving emergency notifications, users will need to visit accountportal.onsolve.net/cambridgema/ to access your account and create a new password.

Was there an impact to user data?
Due to the nationwide cyberattack, Cambridge’s and other CodeRED databases around the country were impacted.  A data breach exposed user data, including phone numbers, email addresses, and passwords. Users who registered for CodeRED alerts with a phone number or email may have been impacted.

The cyberattack was against the OnSolve CodeRed system, and not the City of Cambridge or any City  departments specifically.

What has OnSolve done in response?
The CodeRed platform was taken offline following the cyberattack and decommissioned. OnSolve has since successfully migrated to a new platform on a separate, non-compromised environment that has included comprehensive security audits. 

The new CodeRED by Crisis 24 platform has imported contact information for residents that were previously registered in the system. Because of security concerns associated with the November cyberattack, passwords for all registered accounts have been removed from the new platform. 

What should users do?
If you have an account or previously registered for CodeRED, please visit CodeRED by Crisis24 to access your account.

Users will enter their username (most likely an email) and then select “forgot password” in order to verify and reset your password. If users forgot their username, select “forgot username” and the account and password can be reset.

As a reminder, all users of the system should not utilize their old CodeRED passwords as they may have been compromised. Strong, unique passwords should be utilized on all accounts.  Once your password is reset, you will be able to update and verify your information.

If users set up their old CodeRed account with a password and utilized the same password for other personal or business accounts, the City strongly recommends changing those passwords immediately.

Other resources
If residents feel they have been victimized by cyber-enabled fraud, please report the incident to the FBI Internet Crime Complaint Center at https://www.ic3.gov/. Additional resources to help protect yourself and loved ones from fraud and cybercrimes are available.

Additional details
New registrants may sign up for the service through the Cambridge Alert Network or by registering directly through CodeRED by Crisis24

The City of Cambridge thanks the community for its patience as staff have worked with OnSolve to ensure emergency alert capabilities are fully and securely restored.

Any breach of security, particularly of this magnitude, is a significant concern. While emergency alert capabilities have migrated to the new CodeRED by Crisis 24 platform, City staff will be actively working with OnSolve to ensure its new security standards are upheld. Furthermore, the City will be evaluating other emergency alerting systems to determine what is most effective for the long-term emergency communication needs of the Cambridge community. 

Questions and Concerns
If you have additional questions or concerns about this incident, please contact CodeRED directly at crsupport@crisis24.com.