Tag Archive for: recovered

Here’s how Yonkers and Albany recovered from ransomware attacks

/in


ALBANY — Yonkers and Albany officials know the long, painstaking and costly recovery that Suffolk County is facing since it experienced a cyber-incursion in September. Each survived ransomware attacks.

The intrusions revealed warnings, mistakes and successes after hackers demanded ransom and threatened to grind the governments to a halt. And even though each city refused to pay the hackers’ ransom, the cost of recovery was steep.

In Suffolk, officials said some residents’ “personal information” was accessed in the Sept. 8 attack and urged them to closely monitor their bank accounts and credit reports. The hackers are seeking an unspecified “small reward” for identifying vulnerabilities in the system. The county didn’t have cybersecurity insurance.

Albany’s computer system was attacked at 4 a.m. on a Saturday, March 30, 2019.

“The lights [were] off, or appeared to be off,” said Rachel McEneny, the city’s commissioner of administrative services.

By 11 a.m., the attack was mostly over. Critical systems were intact, including human resources data, and there was no interruption of 911 calls or water service. The city shut down the attack before the ransomware hit the payroll and purchasing programs, but the hard and expensive work of restoring data and repairing damage had just begun, McEneny said.

Some data, such as building permits, was lost and took months to restore, McEneny added.

The attack cost Albany $300,000 for software, hardware and consultants, and the city increased its cybersecurity budget by 25%.

The lessons learned included the need to buy cybersecurity insurance and to bolster staff and resources. Managers also reminded workers to adhere to “cyber-hygiene.” That means workers need to be reminded that they can’t use their government computers or programs to check personal email, social media or to shop online.

Within a few hours of the attack, it was believed to have been stopped by blocking off programs, including police and fire dispatching, 911 emergency calls, and all the essential, daily services of local governments. Other data, such as reams of birth and death records, was lost, and officials believed the database…

Source…

How a Seattle-area school district recovered from a ransomware attack

/in


Written by Lindsay McKenzie
Aug 16, 2022 | STATESCOOP

The Northshore School District, appropriately located on the northern shore of Lake Washington, near Seattle, was the victim of a major cyberattack in 2019.

The incident made national news, headlines that Jon Wiederspan, the district’s network operations manager, said Tuesday still haunt him nearly three years on.

“We first found out about [the attack] at 5 a.m. on a Saturday and we had scheduled an update to our student information system,” Wiederspan said during an online event hosted by the K12 Security Information Exchange. “When the system analysts logged in, the student information system wasn’t there. Instead, there was a page advertising Ryuk.”

Ryuk is a prominent type of ransomware that first cropped up in 2018, quickly building a reputation for targeting government, education and health-sector entities worldwide, racking up $150 million in payments by the end of 2020. (The gang behind the Ryuk malware followed it with another ransomware known as Conti.)

“In cases like this, it’s my job to decide who needs to be woken up. In this case, it was absolutely everybody,” Wiederspan said. “It’s not fun to call your supervisor and say, ‘we think everything is down.’”

As a result of the 2019 incident, many of the Northshore School District’s Windows-based systems were rendered non-operational. Luckily, Wiederspan said, some key resources were running on Linux servers. E-mail and student file storage were also unaffected.

Though many of the tools required for instruction were still operational, Wiederspan said he and his colleagues “knew the damage behind the scenes,” like the system used for sales in school cafeterias.

“We serve 10,000 meals a day,” he said. “We were tracking them by hand for two weeks.”

It took about three weeks to repair access to critical services, including rebuilding the entire active directory domain and restoring file permissions on a server with “millions” of files, Wiederspan said. It would take another three-and-a-half months for the school district to completely recover from the…

Source…

Weapons, narcotic substances, mobile phones recovered from high-security Parappana Agrahara jail

/in


Bengaluru: In a surprise raid led by senior police officials here, a large number of weapons, narcotic substances, mobile phones and SIM cards were found in the high-security Parappana Agrahara jail on the outskirts of the city.

The raid was carried out by officers of the Central Crime Branch (CCB) in the wee hours of Saturday.

“The Central Crime Branch officers conduct a raid every three months in the prison and today’s was no different. Due to the Covid-19 pandemic, the cells of the prisoners had not been checked and thus a raid was carried out today. During the raid, sharp objects cut from utensils provided to the prisoners, a couple of mobile phones and SIM cards were found in their possession. We are investigating further,” said Ranganath.

“We will investigate whether the jail staff were involved,” he added.

Source…