About a week after a cyberattack that crippled Bucks County's computer-aided emergency system, officials announced Friday that they believe they know who was responsible for the attack. The Akira ransomware group is believed to have claimed responsibility for that attack, according to the Department of Homeland Security.
See also: Akira Ransomware: American energy company victim of cyberattack
According to county officials, those responsible for the attack targeted the emergency dispatch system that supports dispatchers, call workers and 911 operators to prioritize and record calls , track the status and location of responders in the field and efficiently dispatch responder personnel.
Provincial officials announced that “the province has notified its local, state and federal partners that Akira ransomware is involved, so that they are aware of the situation and can update their own systems.”
However, officials said all 911 call centers and radio systems remain operational as they investigate the cyberattack.
According to the Ministry of Health and Social Solidarity, Akira is a Ransomware-as-a-Service (RaaS) group that began operations in March 2023.
See also: Authorities warn the healthcare sector about Akira ransomware
“The group has focused on multiple sectors, including finance, real estate, construction and healthcare,” the Department of Health and Human Services said, noting that the group typically demands ransom payments in these cyberattacks.
Without this system, Bucks County officials say the county has lost automated services powered by CAD, and law enforcement cannot access databases for the Commonwealth Law Enforcement Assistance Network nor the National Crime Information Center.
Officials said they are working with state and federal law enforcement partners to help investigate the cybersecurity incident. The county's IT department is working to get systems back up and running as quickly as possible.
Ransomware-as-a-Service (RaaS) is a cyber business model wheremalicious actors provide ransomware services as a service, similar to how legitimate cloud businesses operate.
See also: DragonForce Ransomware: Attacked Yakult Australia
RaaS providers create and distribute ransomware, while their customers (often other malicious actors) use it to carry out attacks. This allows customers to carry out attacks without having to have specialized knowledge or hacking skills.
The RaaS model is profitable for providers, as they often receive a percentage of the compensation paid by victims of attacks. This provides them with an incentive to create and distribute more advanced and dangerous ransomware.
☁️ Keep safe copies with Proton Drive
Encrypted cloud storage from Proton — protect your files from ransomware, corruption, and data loss with end-to-end encryption.
- ✔ End-to-end encrypted files & backups
- ✔ Version history — recover files after ransomware
- ✔ Free space — sync across all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
RaaS increases the accessibility of ransomware, making it widely available to malicious actors. This can lead to an increase in ransomware attacks and greater diversity in the types of attacks being carried out.
RaaS services often include support for their customers, providing guidance on executing attacks and handling compensation. This makes RaaS even more attractive to malicious actors who lack cybersecurity experience.
Source: nbcphiladelphia
