Lake City, Florida, had its computer systems fell as victims of sophisticated ransomware that affected its servers, email networks, and phone lines. After the city paid out $460,000 worth of Bitcoins to the hackers, the city fired its director of information technology.
According to the local WCJB-TV, city manager “Joe Helfenberg confirmed that the director of information technology, Brian Hawkins, was fired.”
Lake City officials described the incident as a "triple threat."
It happened when an employee downloaded an infected document from an email. This set off a chain of events which involved three separate malware attacks.
The initial document carried the Emotet trojan, installed itself to the employee's computer. It then downloaded another trojan called TrickBot and the Ryuk ransomware. It was Ryuk that spread throughout the city's computer systems, locking them down and demanding a ransom.
Only the police and fire department systems were not affected as they were running on a different server, according to The New York Times.
Rather than working for ways to decrypt, the officials determined that it would be cheaper to just pay the hackers.
They reflected to the case that happened earlier this 2019, when Baltimore City was also hit by a ransomware attack in which hackers demanded payment in Bitcoin. The city refused to pay, and hackers began leaking sensitive government documents on Twitter.
After considerations, Lake City gave an approval to its insurance company to pay the 42 Bitcoin ransom, and paid $10,000 excess using taxpayer funds.
“Our city manager did make a decision to terminate one employee, and he is revamping out whole IT department to comply with what we need to be able to overcome what happened this last week or so and that’s so it doesn’t happen again,” Lake City Mayor Stephen Witt said.
Paying ransom for ransomware attacks is controversial because it' seen as a move that further encourage future attacks. Not paying them on the other hand, may result in expensive recovery or worse: total loss of data, or data leak.
According to FBI cyber crimes supervisory special agent Joel DeCapua:
"Second, organizations that pay a ransom think their problems are over. But a lot of times there’s a lot of nasty malware left on their systems that they don’t know about. You can pay, but there’s still malware on there, re-infecting the system or stealing information."
While ransomware attacks may have declined in varieties, but the Ryuk malware is seeing an increase in usage, according to a report from ransomware support firm Coveware.
On average, according to the report, Ryuk demands around $288,000 per attack. This is significant as attackers using Ryuk often target larger organizations that have the financial capacity to pay larger demands and a lower tolerance for downtime.
This is also the reason why cryptocurrency payments made to ransomware attackers have increased by more than 90 percent from $6,733 in Q4 2018 to $12,762 Q1 2019.
Read: The Rising Ransomware Payments In Q1 2019 Caused By 'Ryuk' Targeting Large Organizations
