The city of Knoxville, Tennessee shut down a large portion of its computer network after being hit by a ransomware attack on Thursday.
The attack was first discovered by members of the Knoxville Fire Department at 4:30 a.m. Shortly after the attack was detected, Knoxville chief operations officer, David Brace, notified employees of the breach in an email. City officials believe but have yet to confirm, the attack was launched when a city employee opened a phishing email.
“Please be advised that our network has been attacked with ransomware,” Brace told employees. “Information Systems is currently following recommend[ed] protocols. This includes shutting down servers, our internet connections and PC’s. Please do not log in to the network or use computer applications at this time.”
The city’s website was unreachable earlier in the day. By evening, access to the site was restored after city employees moved it to a temporary domain. The fire and police departments operated as normal, per officials, although police were unable to respond to minor traffic accident reports.
According to Brace, the city has received a ransom demand. Though Brace has so far declined to reveal the amount, he says forensic analysts and risk management consultants are working with law enforcement to resolve the breach. The attack has also been reported to the FBI and the Tennessee Bureau of Investigation. At this time, Brace says there’s no evidence of financial or personally identifiable information being accessed during the breach.
While city servers were affected during the breach, city IT officials believe the threat has been isolated. Brace added that no backup servers were affected and much of the city’s work could be rerouted through them. Meanwhile, Knox County said on Twitter it had no evidence of its systems being affected as a result of the Knoxville breach.
Knoxville isn’t the first city to be hit by a ransomware attack. Brett Callow, a researcher at security firm Emsisoft, found 113 state and municipal government agencies were infected by ransomware in 2019.
-
Honor Magic8 Pro reviewReviews Honor's flagship smartphone pushes the limits with its outstanding lenses and a huge amount of on-device AI functionality
-
Post-cloud strategy: What Comes After Hyperscale?Rising geopolitical risks and data sovereignty laws are driving enterprises toward regional clouds and hybrid infrastructure strategies
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacks
News Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
