Around the end of May, cybercriminals infiltrated computer systems in the city of Florence, Alabama, and infected them with ransomware . The city's IT department is working with an outside agency to investigate the attack.
KrebsOnSecurity has been informed by several Florence city officials about the ransomware attack. According to officials, the hackers are demanding bitcoin $300,000 worth of to “free” the encrypted systems.
The city's mayor had been notified by KrebsOnSecurity that the Windows 10 system in their IT environment was being controlled by hackers, a few days before the attack.
Information shared by dark webexpert Yuliana Bellini, combined with evidence provided by city officials, showed the username for the computer the attackers had used to gain access to the city's systems administrator.
Florence Mayor Steve Holt confirmed that a ransomware attack led to the email . A system administrator who contacted Krebs said the compromised systems have been isolated.
“We know they have some of our information, but we don’t know if they have our critical information. I honestly don’t think they do, but we don’t know,” said Mayor Holt.
Initial reports say that city officials are considering paying the ransom to the hackers to keep data their citizens'.
The city's systems are said to have been infected with DoppelPaymer ransomware. The attack was detected in June. Typically, the operators of this ransomware demand a ransom in Bitcoin, worth $25,000-$1,200,000.
In the image below, you can see the note the ransomware gang left for city officials:
DoppelPaymer ransomware steals victims' data before it begins encrypting it and threatens to publish it onlineif a ransom is not paid. The mayor is said to have asked for assurances that the data will be deleted once payment is made.
