Hacked Texas government agencies face $2.5 million ransom
The number of affected municipalities has dropped to 22, all of which are refusing to pay up


The hackers who launched simultaneous ransomware attacks on Texas State government municipalities have reportedly demanded a $2.5 million payout to unlock the infected systems.
As more details trickle out about the case which was previously spoken about with great restriction from investigating authorities, it has been revealed that the number of affected government entities has dropped from 23 to 22.
Responders have identified and engaged all of those affected and are working to regain control and access to the systems. No ransoms have been paid as of yet, according to Elliott Sprehe, a DIR spokesperson who spoke to NPR.
The Texas State Department of Information Resources (DIR), a government information portal providing technology advice to state authorities, noted that "more than 25% of impacted entities have transitioned from response and assessment to remediation and recovery, with a number of entities back to operations as usual".
Most of the affected departments were based in rural locations and only two of the 22 affected departments have released statements regarding their respective attacks.
"This attack has impacted normal City business and financial operations and services, however, the City has implemented its continuity of operation plans and the City continues to provide basic and emergency services (Police, Fire, 9-1-1, Animal Control, Water, Wastewater and Solid Waste Collection)," said officials from the City of Borger.
"Currently, Vital Statistics (birth and death certificates) remains offline, and the City is unable to take utility or other payments.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
"Based on the current state of the forensic investigation, it appears that no customer credit card or other personal information on the City of Borger's systems have been compromised in this attack. No further information about the origins of the attack will be released until the completion of the investigation."
The other city to have spoken out about the attack is Keene, the mayor of which said the hacker used island hopping, an increasingly popular method of cyber attack to breach the city's IT systems.
"They got into our software provider, the guys who run our IT systems," said Keene Mayor Gary Heinrich to NPR. "A lot of folks in Texas use providers to do that, because we don't have a staff big enough to have IT in house."
Heinrich added that many other targeted municipalities also use the same managed service provider (MSP).
"US government bodies have recently been a major target for ransomware attackers as they have been seeing huge payouts from their attacks, with numerous governments giving into attacker demands and reportedly paying ransoms," said Robert Ramsden-Board, VP of EMEA at Securonix.
"It is therefore not surprising the attackers in this instance are demanding such a huge amount of money - if it worked with previous government agencies, why should it work again?
"However, it generally is never recommended to pay ransom demands as this only fuels the industry. Instead, the best defence against ransomware is a comprehensive security program that protects against known threats and malicious intent or behaviour."
Heinrich was the individual to disclose the $2.5 million ransom demand and said that everything that's done at City Hall is impacted.
19/08/2019: Texas government sites hit by coordinated ransomware attack
A coordinated wave of ransomware attacks successfully struck 23 government entities simultaneously in Texas on Friday morning.
All 23 sites, which have so far been kept anonymous by the State of Texas, reported difficulties accessing the Department of Information Resources (DIR), a government information portal providing technology advice to state authorities.
So far it's unclear precisely what damage has been caused by the attacks, however, investigators have said they believe that based on its timing it's likely it came from a single source.
All government entities that have been affected or could potentially be affected have been notified, although it has been confirmed that Texas State systems and networks remain operational.
The DIR, FBI, FEMA, Texas A&M University, the Texas military department and a host of others are being deployed to lend assistance to the affected entities.
"Investigations into the origin of this attack are ongoing; however, response and recovery are the priority at this time," said the DIR.
"In addition to the regular 'hacker's benefits' of gaining access to customer data, an attacker who penetrates a city's system may get access to sensitive residents information," said Liron Barak, CEO at BitDam. "Depending on the IT structure of the targeted local government, hackers can have an impact on multiple systems, beyond just customer information databases.
"From an attacker's perspective, the potential in hacking a city is much higher than the potential in hacking a commercial organisation," she added. "In addition, local governments tend to communicate with a wide variety of businesses and individuals, with many of them being one time contacts. This makes them more vulnerable to attacks, as their employees don't know most of the contacts with whom they communicate in person."
Although 23 is a significant number, it's actually a comparatively small number in terms of the total 5,343 government entities there are in Texas. At this time, it's unclear how many were targeted compared to how many were successfully infected.
The type of ransomware has been identified as '.JSE', according to a local source speaking to ZDNet.
Operating differently to most other ransomwares, .JSE doesn't leave a ransom note behind after it encrypts files and adds the .JSE extension to the end.
It's the latest in a string of ransomware attacks on smaller US targets in recent months. In May, the city of Baltimore was hit by ransomware that crippled its public services, including those that control tax payments, water bills and parking tickets. This was followed a month later by attacks on two Floridian towns, both within the same week.
"Not only have ransomware attacks been growing, but the amounts they have been demanding has been getting higher, and there has been more specific targeting of victims," said Javvad Malik, security awareness advocate at KnowBe4.
"Recently Florida city agreed to pay $600,000 in ransomware after being affected," he added. "So this co-ordinated attack against Texas may be as a result of seeing how cities or city departments are potentially willing to pay a ransom."

Connor Jones has been at the forefront of global cyber security news coverage for the past few years, breaking developments on major stories such as LockBit’s ransomware attack on Royal Mail International, and many others. He has also made sporadic appearances on the ITPro Podcast discussing topics from home desk setups all the way to hacking systems using prosthetic limbs. He has a master’s degree in Magazine Journalism from the University of Sheffield, and has previously written for the likes of Red Bull Esports and UNILAD tech during his career that started in 2015.
-
How to implement a four-day week in tech
In-depth More companies are switching to a four-day week as they look to balance employee well-being with productivity
-
Intelligence sharing: The boost for businesses
In-depth Intelligence sharing with peers is essential if critical sectors are to be protected
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crime
News A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
-
Everything we know about the Ingram Micro cyber attack so far
News A cyber attack on Ingram Micro severely disrupted operations and has been claimed by the SafePay ransomware group.
-
A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'
News The Hunters International ransomware group is rebranding and switching tactics
-
Swiss government data published following supply chain attack – here’s what we know about the culprits
News Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackers
News While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabs
News An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs