Meriden resident says city waited too long to warn about possible data breach

Meriden resident Sean McDonald is criticizing the city for waiting until June 3 to warn people about a possible data breach tied to a February network incident that disrupted municipal systems and may have exposed sensitive personal and financial information.

The timing of that notice is now the central issue. Meriden first publicly described the event in mid-February as an attempted interruption of its internet services, but residents did not receive breach letters until months later.

According to reporting on the June 3 notice, the city said an unauthorized third party accessed its network environment earlier this year. The letter said the data that may have been exposed included names, Social Security numbers, driver’s license numbers, bank account numbers and routing numbers.

The notice said there was no evidence the information had been specifically misused. It also said the FBI is investigating.

From February incident to June notice

Meriden publicly reported the disruption on Feb. 17, 2026, describing it as an attempted interruption of city internet services. City officials said emergency services were not affected and said a comprehensive review would be conducted.

By Feb. 18, officials said the investigation was ongoing, city hall remained offline and staff were working manually while coordinating with outside agencies.

On Feb. 25, officials said the cyber investigation was still underway and that the city would provide additional updates as appropriate.

Reporting on April 23 said some city services had returned, including online bill pay and hybrid meetings. City spokesman Anthony Terzi said at the time that the February incident affected all city departments.

That sequence is what makes the June 3 notice so consequential. Residents were already aware of a major city network disruption, but the breach warning itself did not arrive until nearly four months later.

What the notice said

The June 3 letter said affected residents were being offered two years of credit monitoring, TransUnion fraud assistance and identity theft and fraud resolution services.

McDonald said he declined those services because he does not want to provide more personal information to a system that may already have been compromised. His criticism is not only about the possibility of exposure, but also about the delay in disclosure.

The city has not responded to emailed requests for comment in the public reporting cited for this story. That leaves its explanation for the timing of the June notice unresolved in the public record.

Why the delay matters

The gap between a February incident and a June warning can affect how quickly residents watch for fraud, place alerts on accounts or change passwords and financial safeguards.

The stakes are not theoretical. Names, Social Security numbers and banking details can be used in identity theft, account fraud and other forms of financial abuse if they fall into the wrong hands.

The city’s notice said there was no evidence of specific misuse, but that does not eliminate the risk if data was exposed. The FBI investigation could eventually clarify whether the incident involved criminal intrusion, what data was accessed and whether any information was actually used improperly.

What remains unclear

The public record still does not say how many residents received the June 3 notice, whether more notices are expected or whether the city sent letters in phases.

It is also not clear exactly what data was accessed beyond the categories named in the notice, or why the city waited until June to send breach letters after the February incident.

For now, the story remains a question of disclosure as much as cybersecurity: what happened in February, what data was touched and whether residents were told soon enough to protect themselves.

That uncertainty is why McDonald’s complaint is resonating beyond one resident. The underlying incident disrupted city operations, and the delayed notice has now become part of the public accountability debate around Meriden’s response.