The city of Knoxville, in the US state of Tennessee, was forced to shut down its IT network after a ransomware attack.
The ransomware attack took place on the night between June 10 and 11. The city's IT department did not detect the intrusion in time and so the ransomware managed to encrypt many systems.
Upon becoming aware of the attack, IT staff shut down the servers and workstations, and took the city's network offline. This resulted in the city's internal IT network, its public website , and the courthouse network being down.
Knoxville emergency services, such as police, fire , and hotlines, were not affected as they operated on separate systems . Knox County 's network was also not affected , although it shares some IT systems with the city of Knoxville.
Knoxville employees who arrived at work yesterday morning saw an email informing them of the attack. The email stated that a ransomware attack and asked employees not to log into their computers.
City officials said they are looking into an email opened by an employee. They believe that was the initial entry point for the ransomware. However, that is just a theory. A thorough investigation, and city officials are also receiving assistance from the local FBI.
The name or type of ransomware that hit the city has not yet been revealed. Lately, many ransomware have been stealing data from infected networks, before encrypting it, and then publishing or selling it online.
Knoxville joins the growing list of U.S. cities that have been hit by ransomware. Most ransomware attacks target smaller cities. But sometimes, they infect the network of a larger city, such as Atlanta, Baltimore, Denver, New Orleans, and now, Knoxville.
In July 2019, the US unanimously agreed to stop paying ransoms ransomware (something that doesn't always happen).
