Almost one month after Jackson County computers and digital records were taken hostage in a malicious cyber attack, the county is still working to recover – and is grappling to do so with no end in sight.
“The issue has not been completely resolved; we are still in the recovery and rebuilding phase,” said County Judge Jill Sklar. “We’re doing everything we can to be able to continue our day-to-day operations, but it’s not nearly as efficient as it should be.”
Jackson County officials first discovered hackers had penetrated their computers and internal network May 28. The hack has affected the county sheriff, district attorney, district clerk and other offices, Sklar said.
When county officials attempted to have access returned, the hackers refused and instead demanded a ransom payment for the hostage computers and their data, Sklar said.
Sklar said the amount demanded was requested in the form of Bitcoin, an untraceable digital currency often used in similar transactions. She declined to share the amount requested but said “it is an enormous ransom that our county can’t afford.”
“Even if we were to pay the ransom, that doesn’t mean that’s the end of it,” she said. “We’d still have to completely sanitize our system and take every measure to try and prevent this from happening again.”
Sklar said the county’s computers were likely accessed through the method of phishing, in which hackers gain access by sending seemingly regular emails. She said experts suspect the attack came from a virus called Ryuk.
“It’s as easy as clicking on the wrong email that’s not legit, but it looks legit,” she said. “The enemy is just getting better and better and more sophisticated to trick the user.”
The cybercrime facing Jackson County isn’t uncommon. It is predicted that a ransomware attack will hit a business every 14 seconds by the end of 2019 and every 11 seconds by 2021, according to cybersecurity researcher Cyber Ventures. The prediction does not include attacks on individuals, which are even more common. Cyber Ventures predicts that damages from ransomware attacks across the globe will reach $20 billion by 2021, which is 57 times more than the prediction for 2015.
Just one day after the attack hit Jackson County, the city of Riviera Beach, Fla., was also hit with an attack. The town’s city council recently voted to pay the ransom 65 bitcoin ransom, which is equivalent to just under $600,000, according to an article in the Palm Beach Post. Sklar said experts think Riviera Beach was also hit by the Ryuk virus because the two attacks share many similarities.
“We’ve been told over and over again that no matter what you do, you can’t protect yourself 100%, so no one is completely safe,” she said.
Jackson County staff members are still working despite the ongoing hostage situation. Sklar said employees are using hotspots and “basically triaging secure services to maintain continuity of business.”
The county has been working with outside agencies to recover. They’ve had teams of experts gathering forensics and working to essentially rebuild their network, she said.
In an attempt to restore the backup data, which was also compromised in the attack, the county has consulted with a California-based IT company that specializes in data recovery, but Sklar said the company was unsuccessful. They are still exploring other options to recover the information.
Regarding costs, Sklar said Jackson County already has spent about $50,000 on new equipment, expenses to get computers back online and efforts to rebuild the network. She said she is not confident that they are done spending money.
Victoria County IT Director John Sestak said the attack against Jackson County brought the need for security to the “forefront to our county officials’ minds.”
In December, Victoria County commissioners approved a contract that included a new cybersecurity policy with Frost Insurance,after Sestak recommended the county purchase a liability insurance policy to help protect it in the event of a data breach. He said he hopes the insurance policy will help the county recover if it ever faces a similar attack.
“In the IT department, we know cyberattacks are always a threat,” he said. “And seeing it happen nearby made us all recognize, ‘Hey, yes, this is real, this can happen.’”
Sklar said Jackson County staff are exploring new options for cyber insurance. Until then, they are “doing all we can to work through the situation.”
“It’s a slow, complicated process to rebuild a network that takes time, resources and more time if you want to do it well,” she said. “We’re moving at a slow pace because we don’t want to end up in the same situation.”