A group of hackers carried out a ransomware attack on the city of New Bedford, Massachusetts , and demanded $5.3 million to decrypt the data. However, the city refused to pay that amount, stating that it could only give $400,000. The hackers refused this offer, and city officials decided to recover the files from backups.
The attack happened in early July, but details were released yesterday when New Bedford Mayor Jon Mitchell held a press conference and described the incident and how the city handled it.
Only 4% of the city's systems were affected
The attack took place on the night between July 4 and 5.
Hackers breached the city's network and installed Ryuk, the most widespread ransomware of the time, used to carry out targeted attacks.
The ransomware spread through the city's network, encrypting files on 158 workstations, or 4% of the city's total computers.
The fact that the attack took place at night, when most of the city's systems were down, is a positive, according to police. And it was a positive because the ransomware couldn't spread throughout the entire network.
The city's IT staff discovered the ransomware attack the next morning and rushed to disconnect all infected computers from the city's network to prevent the virus from spreading.
The attacker had left a contact email, so city officials contacted him while the attack was still in progress.
The attacker responded and said he would “unlock” the encrypted files if the city gave him $5.3 million.
It is the largest amount of money ever demanded after a ransomware attack. The city did not pay the amount, mainly because it did not have the money.
The mayor knew from the beginning that the city did not have these funds, but decided to start a conversation and negotiation with the attackers in order to give more time to the IT staff to strengthen the defenses and reduce the chances of a second consecutive attack occurring.
Mayor Mitchell decided to make the hackers an offer of $400,000, which is roughly what other cities have paid in similar cases. However, the attackers rejected the offer.
So, since there was no agreement, the mayor of New Bedford decided to recover the files from backups.
The recovery process wasn't too difficult because the ransomware hadn't affected many files or any very important systems.
In recent months, several US cities have been targeted by ransomware gangs (Texas, Louisiana, Florida, Georgia, and others).
