Colorado law enforcement agencies look to cancel contract with hacked emergency notification system

Douglas County and other Colorado jurisdictions are moving to terminate or review contracts with the OnSolve CodeRed emergency-notification platform after access was suspended Nov. 10 following what the vendor (Crisis24/OnSolve, owned by Garda World) calls a targeted cybercriminal attack. The company warns legacy platform data — including usernames, passwords, names, addresses and phone numbers — may have been removed and has offered temporary access to an alternate platform; affected counties are weighing legal remedies and replacement systems, which may increase costs and force reliance on manual alerting in the interim.

Analysis

Market structure: This incident shifts near-term wallet share from single-vendor alert platforms (OnSolve/legacy providers) to specialist cybersecurity and resilient comms vendors — expect demand uplifts for endpoint/infra security and multi-channel alerting (SMS, cell broadcast, hardened SaaS). I estimate municipalities may reallocate 2–5% of IT/ops budgets to security/notification upgrades within 6–12 months, benefitting public-cloud security leaders and cyber-focused integrators.

Risk assessment: Tail risks include regulatory/FTC-style privacy fines or class-action suits against the provider (months) and coordinated disclosure of data leading to reputational contagion across small vendors (weeks–quarters). Hidden dependencies: SMS gateway carriers, regional 911 systems, and state-level AMBER/alerts create second-order failure points; a wider outage or proof of published data in 30–90 days would materially accelerate vendor churn.

Trade implications: Tactical overweight cyber names/ETFs (HACK, CIBR; and leaders CRWD, PANW, ZS, FTNT) for 1–3% portfolio positions, using 6–12 month bullish option structures to capture re-rating; consider modest long defense/security infrastructure exposure (LHX) for resilient comms contracts. Avoid/trim direct exposure to legacy alert vendors and mid-cap municipal software names (e.g., TYL) where integration risk and contract churn could compress margins over 2–4 quarters.

Contrarian angles: The market likely underprices durable capital spend — SolarWinds-like events produce multi-year demand for telemetry and zero-trust; if 3+ counties terminate contracts within 60 days, accelerate buys. Reaction may be overdone on pure legal risk to large security vendors; favor incumbents (CRWD, PANW) over unproven niche providers because procurement cycles favor established SLAs and insurance acceptance.

Key Decisions for Investors

• Establish a 1.5–3% net long position in cyber ETF HACK and CIBR (split) within 2 weeks to capture municipal and local-government re-platforming over 6–12 months.
• Initiate concentrated long exposure: buy 6–12 month call-spread positions (bull call spreads) on CRWD and PANW sized ~0.5–1% notional each (5–15% OTM strikes) to limit premium spend while capturing an expected 15–30% re-rating if procurement shifts accelerate within 3–9 months.
• Reduce or trim 1–2% exposure to municipal software vendors exposed to emergency-notification integrations (example: TYL) and redeploy into cyber names; re-evaluate if >3 municipal cancellations are publicly announced within 60 days.
• Add 0.5–1% long to LHX (or similar defense/communications contractor) for multi-year hardened-comm contracts; increase to 2% if state-level procurements (RFPs) for alternate alert systems appear within 90 days.
• If data is publicly leaked/published within 30 days, buy 3–6 month protection (buy puts or tail hedges) on small-cap municipal IT names and increase cyber longs by 50% of original size within 7 trading days.