Garfield County, Utah, was recently affected by ransomware. Local government is an increasingly attractive target for criminals because of its high dependence on information technology, and generally poor security. Elected officials are under constant pressure to spend available funds on something visible and appealing to the electorate rather than unseen technology.
Little is known about the Garfield attack. In brief, it appears that an employee clicked a phishing link that gave the criminals access. Having gained access, the ransomware apparently encrypted enough systems to require County officials to switch to paper administration; although it is reported that the courts, elections and sheriff’s office were not affected.
The type of ransomware and any suspected culprits has not been made public. It can be assumed that the attackers either compromised back-ups systems, or the back-ups were simply inadequate — the county attorney said that a ransom in Bitcoin was paid in order to retrieve files.
Some ransomware attacks are blended with data theft attacks. It is difficult to know what happened to Garfield. The county attorney commented, “All of our data had been taken,” and, “We’ve learned that even in Panguitch, people could steal your data.” However, since there is no obvious personal information data breach disclosure coming from Garfield County, it is possible ‘stealing data’ refers only to reversible encryption.
The ransom was paid, and the systems restored in March. There is no current indication on the value of the ransom. However, also in March 2019, Jackson County, Georgia, paid a ransom of $400,000 for decryption keys following an attack involving what is thought to be the Ryuk ransomware.
Cities and counties are under enormous pressure to simply pay any ransom following the example of the SamSam attack on the City of Atlanta in March 2018. Although the city refused to pay the ransom of around $51,000, it was reported that another $9.5 million budget would be required for recovery costs.
Although official advice is to never pay a ransom, the cost and disruption experienced by Atlanta can make that a difficult call.
Two Iranian citizens were indicted by the U.S Department of Justice in November 2018 for their alleged role in developing and deploying SamSam.
Other recent ransomware attacks on local government include the city of West Haven in October 2018 ($2,000 ransom paid); Madison County, Indiana (where the ransom was probably paid, but the amount not disclosed).
Related: Europol Declares War on Ransomware
Related: GandCrab 1,4 and 5 Decryptor Available
Related: SamSam and GandCrab Illustrate Evolution of Ransomware
Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.
More from Kevin Townsend
- Google Introduces SAIF, a Framework for Secure AI Development and Use
- SaaS Ransomware Attack Hit Sharepoint Online Without Using a Compromised Endpoint
- Sysdig Introduces CNAPP With Realtime CDR
- OWASP’s 2023 API Security Top 10 Refines View of API Risks
- Zoom Expands Privacy Options for European Customers
- SBOMs – Software Supply Chain Security’s Future or Fantasy?
- Threat Actor Abuses SuperMailer for Large-scale Phishing Campaign
- Quantum Decryption Brought Closer by Topological Qubits
Latest News
- Blackpoint Raises $190 Million to Help MSPs Combat Cyber Threats
- Google Introduces SAIF, a Framework for Secure AI Development and Use
- ‘Asylum Ambuscade’ Group Hit Thousands in Cybercrime, Espionage Campaigns
- Evidence Suggests Ransomware Group Knew About MOVEit Zero-Day Since 2021
- SaaS Ransomware Attack Hit Sharepoint Online Without Using a Compromised Endpoint
- Google Cloud Now Offering $1 Million Cryptomining Protection
- Democrats and Republicans Are Skeptical of US Spying Practices, an AP-NORC Poll Finds
- Consolidate Vendors and Products for Better Security
