City of Knoxville faced with ransomware attack
City officials working with law enforcement to address the breach
The city of Knoxville, Tennessee shut down a large portion of its computer network after being hit by a ransomware attack on Thursday.
The attack was first discovered by members of the Knoxville Fire Department at 4:30 a.m. Shortly after the attack was detected, Knoxville chief operations officer, David Brace, notified employees of the breach in an email. City officials believe but have yet to confirm, the attack was launched when a city employee opened a phishing email.
“Please be advised that our network has been attacked with ransomware,” Brace told employees. “Information Systems is currently following recommend[ed] protocols. This includes shutting down servers, our internet connections and PC’s. Please do not log in to the network or use computer applications at this time.”
The city’s website was unreachable earlier in the day. By evening, access to the site was restored after city employees moved it to a temporary domain. The fire and police departments operated as normal, per officials, although police were unable to respond to minor traffic accident reports.
According to Brace, the city has received a ransom demand. Though Brace has so far declined to reveal the amount, he says forensic analysts and risk management consultants are working with law enforcement to resolve the breach. The attack has also been reported to the FBI and the Tennessee Bureau of Investigation. At this time, Brace says there’s no evidence of financial or personally identifiable information being accessed during the breach.
While city servers were affected during the breach, city IT officials believe the threat has been isolated. Brace added that no backup servers were affected and much of the city’s work could be rerouted through them. Meanwhile, Knox County said on Twitter it had no evidence of its systems being affected as a result of the Knoxville breach.
Knoxville isn’t the first city to be hit by a ransomware attack. Brett Callow, a researcher at security firm Emsisoft, found 113 state and municipal government agencies were infected by ransomware in 2019.
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
-
Hacker claims to have stolen millions of Azure customer recordsNews TheHatman claims the data has been stolen from the victims' Azure and Entra tenants using compromised credentials
-
National Grid plans major works to accommodate London data centersNews The program includes new and upgraded substations, new cables, and reinforcement of existing overhead lines
-
Companies are still paying ransoms to cyber criminals despite official adviceNews A Proofpoint survey found evolving ransomware techniques and the use of AI is exacerbating the situation for victims
-
This one cyber crime group accounted for nearly a fifth of all ransomware attacks in JuneNews The Gentlemen, a ransomware a service operator, now accounts for 17% of published attacks
-
Working with the enemy: Ransomware negotiator-turned cyber criminal jailed after working with hackers to extort clientsNews Angelo Martino was supposed to be negotiating on behalf of victims, but was secretly working for ransomware operators
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals