Second Florida city agrees to pay ransomware hackers massive sum

[midian182]

Why it matters: It was only last week when a Florida city agreed to pay hackers $600,000 to unlock the ransomware that had encrypted its files. Now, a second city in the state has done the same thing.

Lake City, which is located in Northern Florida, found its systems infected with ransomware two weeks ago. IT staff reportedly tried to stop the attack within 10 minutes of it starting by disconnecting affected computers, but it was already too late. Workers were locked out of their email accounts, and the 65,000 residents have been unable to pay municipal bills online, or apply for building permits. Police and Fire departments were unaffected as they run on separate networks

"The biggest concern for the public at this moment is the lack of email communication, and we hope to have alternate email contacts available shortly," said city manager Joe Helfenberger, in a statement.

A week after the systems were infected, hackers contacted the League of Cities, Lake City’s insurance provider. A payment of 42 bitcoins, or around $500,000 was negotiated to unlock the systems. While most experts recommend not paying ransoms as there’s no guarantee the criminals will hand over the decryption key, the insurer agreed to the terms because it was the most efficient way of resolving the situation. While insurance covered most of the ransom, $10,000 is coming from taxpayers.

Last week brought news that Riveria Beach in Florida would be paying $600,000 to hackers in the hope of retrieving its systems, which have been locked for more than three weeks after being hit with ransomware.

Ransomware attacks on state and local governments are on the rise, with at least 170 being targeted since 2013, according to a Recorded Future report. With cities handing over so much cash, expect this trend to continue.

Permalink to story.

https://www.techspot.com/news/80698-second-florida-city-agrees-pay-ransomware-hackers-massive.html

 

[VitalyT]

This will likely get more intense, after giving a cookie to the mouse. And it is hard to feel sorry for the country that thinks selling guns in a shop is a good idea. Not to forget, that every freedom comes with a price.

 

[Uncle Al]

If those cities would simply understand their risk and invest that kind of money into protection they would be far better off, but as usual, they have to wait until they learn the lesson the very, very hard way .....

 

[TomSEA]

Any IT Director who lets this happen to their organization should be immediately fired and stripped of any IT credentials/degrees they have.

There's zero excuse for this to happen. At a minimum, backups should be in place.

 

[ckm88]

The city definitely deserves this, but the citizens do not. I just feel bad for the citizens since the costs are going to trickle down to them

 

[hyperwolf83]

Any IT Director who lets this happen to their organization should be immediately fired and stripped of any IT credentials/degrees they have.

There's zero excuse for this to happen. At a minimum, backups should be in place.

Don't be so quick to blame IT. A lot of fail-safes are in place at most locations, but that doesn't stop a random employee from opening an email they aren't supposed to. And if the system is already infected but not yet locked down when a backup is initiated, then the backup copies will be infected as well. A lot of people think having 4 different antivirus apps installed provides full immunity and they can click on whatever they want, but it simply doesn't work like that anymore.

 

[Squid Surprise]

Any IT Director who lets this happen to their organization should be immediately fired and stripped of any IT credentials/degrees they have.

There's zero excuse for this to happen. At a minimum, backups should be in place.

Don't be so quick to blame IT. A lot of fail-safes are in place at most locations, but that doesn't stop a random employee from opening an email they aren't supposed to. And if the system is already infected but not yet locked down when a backup is initiated, then the backup copies will be infected as well. A lot of people think having 4 different antivirus apps installed provides full immunity and they can click on whatever they want, but it simply doesn't work like that anymore.

There should be backups done daily and stored offsite every week - unless no one noticed the infection for more than 7 days, they should always be able to revert to a “safe” backup.

These small towns, unfortunately, run their IT like a bunch of children... and probably pay them accordingly...

 

[TomSEA]

Any IT Director who lets this happen to their organization should be immediately fired and stripped of any IT credentials/degrees they have.

There's zero excuse for this to happen. At a minimum, backups should be in place.

Don't be so quick to blame IT. A lot of fail-safes are in place at most locations, but that doesn't stop a random employee from opening an email they aren't supposed to. And if the system is already infected but not yet locked down when a backup is initiated, then the backup copies will be infected as well. A lot of people think having 4 different antivirus apps installed provides full immunity and they can click on whatever they want, but it simply doesn't work like that anymore.

That's why you should have a daily midnight backup system in place. You can't get more basic IT operations than that. All you have to do is roll it back to the previous day's files - or the day before if you need to. Tens of thousands of business/cities manage to prevent ransomware attacks by doing just that.

 

[j05hh]

Backups & End Users Training.

 

[Scshadow]

I feel like we are morally obligated at this point. We should do this ransomware thing, collect the reward, and then refuse to unlock the systems. That way when someone gets burned, hopefully no one else will pay up anymore.

 

[wiyosaya]

To quote Forrest Gump: "Stupid is as stupid does!"

 

[fluffydestroyer]

I'm so shocked and surprised...said no one ever with a shroud of intelligence

 

[fluffydestroyer]

I thought US citizens, gov or whatever had a "we don't make deals with criminals" kind of thing going on. Unless thats what we only see in movies. Because NOT making a deal with criminals makes so much sense.

 

[hk2000]

I don't get it- there is no way someone collects the ransom without a way to lead back to the culprits, unless of course governments are involved, in which case I think the US should Identify those governments and declare war on them. That's the only way to truly stop these attacks.

 

[Squid Surprise]

I don't get it- there is no way someone collects the ransom without a way to lead back to the culprits, unless of course governments are involved, in which case I think the US should Identify those governments and declare war on them. That's the only way to truly stop these attacks.

That's kind of the point of cryptocurrencies.... they're untraceable...

 

[toooooot]

The con of this situation is that this will only lead to more hackers trying to get an honest pay for their hard work.

The pro is that this shows how important security in any company or org. is.
That means more companies would hire an It security expert where if without those ransomware attacks they could go with a very entry level IT worker.

 

[Someone8MyPosts]

Any IT Director who lets this happen to their organization should be immediately fired and stripped of any IT credentials/degrees they have.

There's zero excuse for this to happen. At a minimum, backups should be in place.

Actually, it can happen to anyone at any experience level. The part I don't understand is why most of this stuff wasn't on some kind of backup and restore plan. I get that live systems may lose some data, but this is beyond ridiculous.

 

[Someone8MyPosts]

I thought US citizens, gov or whatever had a "we don't make deals with criminals" kind of thing going on. Unless thats what we only see in movies. Because NOT making a deal with criminals makes so much sense.

Uh...whatever. Politicians are everywhere...so it should be obvious.

 

[Someone8MyPosts]

Any IT Director who lets this happen to their organization should be immediately fired and stripped of any IT credentials/degrees they have.

There's zero excuse for this to happen. At a minimum, backups should be in place.

Don't be so quick to blame IT. A lot of fail-safes are in place at most locations, but that doesn't stop a random employee from opening an email they aren't supposed to. And if the system is already infected but not yet locked down when a backup is initiated, then the backup copies will be infected as well. A lot of people think having 4 different antivirus apps installed provides full immunity and they can click on whatever they want, but it simply doesn't work like that anymore.

That's why you should have a daily midnight backup system in place. You can't get more basic IT operations than that. All you have to do is roll it back to the previous day's files - or the day before if you need to. Tens of thousands of business/cities manage to prevent ransomware attacks by doing just that.

Agreed. There are even better ways to handle this than that, but this is IT 101 at the admin level.

 

[Someone8MyPosts]

Any IT Director who lets this happen to their organization should be immediately fired and stripped of any IT credentials/degrees they have.

There's zero excuse for this to happen. At a minimum, backups should be in place.

Don't be so quick to blame IT. A lot of fail-safes are in place at most locations, but that doesn't stop a random employee from opening an email they aren't supposed to. And if the system is already infected but not yet locked down when a backup is initiated, then the backup copies will be infected as well. A lot of people think having 4 different antivirus apps installed provides full immunity and they can click on whatever they want, but it simply doesn't work like that anymore.

There should be backups done daily and stored offsite every week - unless no one noticed the infection for more than 7 days, they should always be able to revert to a “safe” backup.

These small towns, unfortunately, run their IT like a bunch of children... and probably pay them accordingly...

Sometimes it's a matter of the people holding/controlling the purse strings that control the decisions made and at times not listening to their IT people that results in things like this, as well.

 

[wiyosaya]

Sometimes it's a matter of the people holding/controlling the purse strings that control the decisions made and at times not listening to their IT people that results in things like this, as well.

If this was the case, and the IT people informed the appropriate people upfront about the potential risks, then the IT people should be screaming at those responsible - I told you so!

 

[Gezzer]

If those cities would simply understand their risk and invest that kind of money into protection they would be far better off, but as usual, they have to wait until they learn the lesson the very, very hard way .....

Still won't fix a thing. They'll form a community to study the problem for the low sum of 100-150,000 over a two year period. Once they come to the conclusion that there is indeed a problem that needs to be fixed they'll put it up for bids.

At that point the bid will be awarded to not the lowest bid, or the company with the best track record, but the one with the coolest sounding name. Then the project will be constantly late and running over budget and when finally delivered four years late for the low low cost of 1.5 million will prove to be totally unsuitable for the purpose.

At that point they'll buy an off the shelf solution that would of worked when the breech happened 6 years ago but be totally stale tech at that point that any script monkey can circumvent. But they'll pat themselves on the back saying "job well done" anyway.

 

[Gezzer]

Any IT Director who lets this happen to their organization should be immediately fired and stripped of any IT credentials/degrees they have.

There's zero excuse for this to happen. At a minimum, backups should be in place.

You'd be right if IT had total autonomy in any organization, but they don't. They often have bosses that refuse to listen to reason or give them an adequate budget to do their jobs with. In the public sector it's even worse because many of those bosses are entrenched with jobs for life and are untouchable no matter what their stupidity causes. So the head of IT will lose his or her job, but that doesn't necessarily mean the ***** that let it happen will lose theirs.

 

[VEEJER1]

`Download` the freeware program `ROLLBACK` it continually takes snapshots of your system every time you reboot, you can go back to 7 different `EXACT` time modes on your computer and you can even enter them yourselves, it is `much` better than `System Restore` in fact it makes that program redundant, its a superb program (Very Highly Recommended) your data will be there `exactly` how you left it, also, if you get Ransomware on your computer just simply use the `RollBack` program (in this instance) by switching your computer of at the power switch, wait 20secs, switch back on, and when Rollback screen appears, take your computer back to any one of 7 time modes to `BEFORE` the Ransomware program installed itself, using Rollback will save you having to Re-Install your system, this program has been proved to work in this case, I highly recommend it to you `Google` it now, and read about it, I cannot praise it enough!!!

 

[Athlonite]

It's very hard to mitigate against PEBKAC there will always be some dumb numpty who'll click on some random garbage all you can do is make sure you have a good backup plan in place and try to train the numpties as best you can