A hacker who in April caused a “network disruption” of the San Bernardino County Sheriff’s Department’s computer system was paid a $1.1 million ransom to let county officials back into the network.
The ransom was announced on Friday by SBC officials, who stated that the hacker uploaded ransomware to infiltrate the sheriff’s department’s information technology system.
The disruption included sheriff’s officials being unable to access a system that provides information on whether a person is wanted for crimes elsewhere in the county, SBC Sheriff Shannon Dicus said.
Department officials became aware of the incident on April 7, according to county officials, who said they immediately secured the network and were working with its information technology staff and third-party forensic specialists to investigate.
After the disruption, county officials referred the incident to partnering law enforcement agencies, including the FBI and the Department of Homeland Security.
A ransomware attack occurs when a hacker gains access to a system, usually through malicious software, according to the U.S. Cybersecurity and Infrastructure Security Agency. The attacker then encrypts the server’s data and makes demands in return for its decryption.
During the April disruption, whether the incident involved, a cyberattack or other threat against the sheriff’s department was unknown.
County officials did not say when the $1.1 million was paid to the hackers, how long the system was inaccessible to the department, or why officials waited until now to inform the public about the ransom payment.
The Daily Press submitted several questions to county officials, such as whether the paid ransom had assurances that there would be no additional attacks or how the ransom was paid.
SBC spokesman David Wert on Friday told the Daily Press that further information on the cyberattack could not be disclosed at this time in light of the ongoing criminal investigation.
Why was a ransom paid?
After “careful consideration,” SBC officials opted to pay the $1.1 million ransom to the unknown hacker to regain control of their system. An insurance policy ensured a payout of $511,852 by SBC, county officials said.
“The County had prepared for the possibility of such an incident by securing appropriate insurance coverage,” Wert said. “After negotiating with the responsible party, the insurance carrier and the County agreed to a payment to restore the system’s full functionality and secure any data involved in the breach. Insurance covers most of the payment.”
County officials did not offer details on the other $600,000 that paid the ransom.
The ransomware attack did not impact public safety, Dicus said. Investigators have yet to determine if any information was seized during the malware attack or if the hacker can be tracked.
The sheriff’s department is conducting a forensic examination to fully understand the extent of the incident, with findings crucial to public agencies seeking to avoid similar attacks, county officials said.
A similar cyber attack hits Dallas
San Bernardino County isn’t the only victim of this type of high-tech crime. A ransomware attack on the City of Dallas that “significantly impacted” police and compromised other city services was initiated by a prolific group called Royal, the Dallas Morning News reported Thursday.
Since the City of Dallas’ Information and Technology Services detected a cyber threat Wednesday morning, employees have been working hard to contain the issue and ensure continued service to residents, City Manager T.C. Broadband said.
FBI Dallas Bureau spokeswoman Melinda Urbina said the agency is aware of the attack and is in contact with city officials. She declined to provide additional details about the investigation.
Dallas police Chief Eddie García said in a written statement that the outage had “significantly impacted the department’s operations.
The Dallas Police Department’s website, internal share drives, and applications for personnel matters were also affected, according to the chief.
Jim McDade, president of the Dallas Firefighters Association, said Dallas Fire Rescue has had to revert to a primitive form of manual dispatching reliant radio communication because of the attack.
Royal uses custom-made encryption, the FBI and the Cybersecurity and Federal Infrastructure Security Agency said in a recent joint advisory.
The group originated around September 2022 and has compromised U.S. and international organizations, the agencies said.
Bhavani Thuraisingham, a professor of computer science at the University of Texas at Dallas, said Royal is a sophisticated “gang” that uses traditional and new ways of infiltrating victims’ systems.
Authorities say “threat actors” with Royal gain access to victim networks about two-thirds of the ti through phishing. The group can also access a system through remote desktop control tools, Thuraisingham said.
Royal threatens to publicly release the encrypted data if the victim does not pay the ransom, the FBI said in the advisory. It was not immediately clear what demands Royal might have made to the city of Dallas.
It isn’t clear if Royal is behind the ransomware attack on the San Bernardino County Sheriff’s Department’s computer system.
Click Here For The Original Source.
————————————————————————————-