Ransomware Shuts Down Municipalities; How To Protect Our Cities
On June 9, 2024, the city of Cleveland, Ohio uncovered a “cyber incident” which was later determined to be a ransomware attack. Since the attack, city hall has been closed to the public for over a week. Citizen facing services have been offline as well. To contain the damage of the ransomware, the city shut down the affected systems until they could restore them safely. On a positive note, emergency services, works, utilities and healthcare were not impacted.
Details about the attack have been kept close-hold as the investigation continues. Some employees were allowed back to work on the 12th, but many issues remained. They could not process building permits and birth/death certificates. After over a week, the mayor’s office still has not disclosed what information was exposed. The city did say that they were not negotiating with the hackers and will not pay the ransom.
This is not the first major city in the U.S. to get hit with ransomware. In 2019, the city of Baltimore, MD was hit with a devastating attack that crippled their municipal services for weeks. The cleanup cost the city over $18M. In May of 2023, Dallas, TX was hit with ransomware that disrupted the city’s 911 emergency services. New Orleans, Knoxville, and Las Vegas also have joined the Ransomware Victim Club.
Don’t think that this only happens in faraway places in different states. The city of Kingman, AZ experienced a significant cyberattack where the city’s computer system was compromised. The breach included social security and driver’s license numbers mostly affecting employees.
There are several reasons why hackers target city governments. For one, cities have valuable data. This includes sensitive information such as personal records and financial data. Secondly, hackers assume that municipalities are a soft target. Municipalities often lack the necessary funding and skilled personnel to address technology challenges. Often the IT infrastructure is outdated, making them vulnerable to attack. Lastly, municipalities provide critical services. Hackers think that if they take down critical services, the city will gladly pay the ransom.
Many of these municipalities had cybersecurity services which monitored their systems. So, how did the hacker install the ransomware? The problem with this method is that the hacker must be actively inside the network before the threat can be identified, and sometimes that is too late. New malware (zero-day attack) is not in the antivirus databases and is not automatically stopped.
The solution to this problem is “application whitelisting” or “application allow listing.” With this method only applications which have been validated previously can run on the computer. Even if an employee clicked a malicious link, when the software tried to run on the local system, it would fail. It is not on the allow list. There is upfront friction with this implementation where users cannot load anything they want whenever they want. They submit a request for their new software to be put on the allow list. The cybersecurity personnel validate the software in their testing environment looking for unusual behavior. If it checks out, the software is approved for use.
Another cybersecurity aspect which is often neglected by municipalities is continuous cybersecurity training. The one-time annual cyber classes are not effective. However, if the training is kept short, about three minutes per week every week, delivered to user’s email box, the results are exponentially better. Cybersecurity is top of mind.
The lesson to be learned is that every government municipality is a target, not just big cities. The data is valuable to hackers. If they can take down emergency services, the hackers expect a fast payment. Does your local government have the proper cybersecurity measures in place, such as application whitelisting and continuous training, to avoid the disaster that Cleveland is experiencing?
The original article was published in the Sierra Vista Herald and can be found here.