2019 Baltimore ransomware attack
| Date | 7 May 2019 |
|---|---|
| Time | 8:54 a.m.[1] |
| Location | Baltimore, Maryland, United States |
| Type | Cyberattack |
| Theme | Ransomware encrypting files with $76,280 demand[1] |
| Cause |
|
| Outcome | Multiple municipal services down for months, including databases and applications City spends $18 million in recovering services |
During the Baltimore ransomware attack of May 2019, the United States city of Baltimore, Maryland had its servers largely compromised by a variant of ransomware called RobbinHood. Baltimore became the second U.S. city to fall victim to this new variant of ransomware after Greenville, North Carolina and was the second major US city with a population of over 500,000 people to be hacked by ransomware in two years, after Atlanta was attacked the previous year.
Background
Baltimore had been targeted by ransomware once prior to the May 2019 attack in 2018, though that attack was smaller in comparison and took down the city's emergency dispatch system for a short duration.[2] On May 2, just days before the first infection, mayor Catherine Pugh resigned amidst a corruption scandal and was ultimately convicted and sentenced to 3 years in prison.[3] She was replaced by Jack Young.
Attack
On May 7, 2019, most of Baltimore's government computer systems were infected with the aggressive ransomware variant RobbinHood. All servers, with the exception of essential services, were taken offline. In a ransom note, hackers demanded 13 bitcoin (roughly $76,280) in exchange for keys to restore access. The note stated that if the demands were not met within four days, the price would increase and within ten days the city would permanently lose all of the data.[4][5][6][7][8][9][10] On May 25, security expert Nicole Perlroth speculated that the stolen NSA exploit EternalBlue was used to infiltrate the city's network vulnerabilities and initiate the attack,[11] though in a memoir published in February 2021, Perlroth recanted her original statement after concluding that the exploit was not in fact responsible.[12]
Baltimore was susceptible to such an attack due to its IT practices, which included decentralized control of its technology budget and a failure to allocate money its information security manager wanted to fund cyberattack insurance.[13] The attack has been compared to a ransomware attack on Atlanta the previous year, and was the second major use of the RobbinHood ransomware on an American city in 2019, as Greenville, North Carolina was also affected in April.[14]
Aftermath
The attack had a negative impact on the real estate market as property transfers could not be completed digitally due to the system being down,[15][16] as the city's card payment system and debt checking application were rendered inaccessible. In addition, city employees were unable to use their email system and resorted to creating Gmail accounts as workaround. Google automatically blocked their accounts at first due to the large number of accounts created in that timespan, though the company later restored the Gmail accounts.[17]
The recovery, initially estimated to take several more weeks on May 20,[13] ultimately lasted until September.[18] Frank Johnson, Baltimore's IT director, was put on unpaid leave following the ransomware attack. Since becoming the city's IT director during the Pugh administration, Johnson had been criticized for not having a written disaster recovery plan and for his handling of the 2019 attack, which was estimated to cost the city $18 million.[18] He was replaced by deputy director Todd Carter, who later became the permanent IT director in February 2020 after Johnson left the role in October.[19]
References
- ↑ 1.0 1.1 "The Curious Case of the Baltimore Ransomware Attack: What You Need to Know". 2020-09-08. https://heimdalsecurity.com/blog/baltimore-ransomware/.
- ↑ "Baltimore's 911 emergency system hit by cyberattack". 2018-03-28. https://www.nbcnews.com/news/us-news/baltimore-s-911-emergency-system-hit-cyberattack-n860876.
- ↑ "Catherine Pugh: Baltimore mayor resigns over book scandal". 2021-05-02. https://www.bbc.com/news/world-us-canada-48138639.
- ↑ "A ransomware attack is holding Baltimore's networks hostage". https://www.engadget.com/2019/05/08/baltimore-city-government-ransomware-attack/.
- ↑ Song, Victoria (May 8, 2019). "Baltimore's Government Held Hostage by Ransomware Attack". https://gizmodo.com/baltimores-government-held-hostage-by-ransomware-attack-1834616990.
- ↑ Gallagher, Sean (8 May 2019). ""RobbinHood" ransomware takes down Baltimore City government networks". https://arstechnica.com/information-technology/2019/05/baltimore-city-government-hit-by-robbinhood-ransomware/.
- ↑ Chokshi, Niraj (2019-05-22). "Hackers Are Holding Baltimore Hostage: How They Struck and What's Next" (in en-US). The New York Times. ISSN 0362-4331. https://www.nytimes.com/2019/05/22/us/baltimore-ransomware.html.
- ↑ Liptak, Andrew (2019-05-25). "Hackers reportedly used a tool developed by the NSA to attack Baltimore's computer systems". https://www.theverge.com/2019/5/25/18639859/baltimore-city-computer-systems-cyberattack-nsa-eternalblue-wannacry-notpetya-cybersecurity.
- ↑ "Cyber-spies tight-lipped on Baltimore hack" (in en-GB). BBC. 2019-05-27. https://www.bbc.com/news/technology-48423954.
- ↑ "Microsoft sounded alarm two years ago about NSA hacking tool that reportedly hit Baltimore" (in en-us). https://baltimorebrew.com/2019/05/26/microsoft-sounded-alarm-two-years-ago-about-nsa-hacking-tool-that-reportedly-hit-baltimore/.
- ↑ Perlroth, Nicole; Shane, Scott (May 25, 2019). "In Baltimore and Beyond, a Stolen N.S.A. Tool Wreaks Havoc". The New York Times. https://www.nytimes.com/2019/05/25/us/nsa-hacking-tool-baltimore.html.
- ↑ Perlroth, Nicole (February 9, 2021). This Is How They Tell Me the World Ends: The Cyberweapons Arms Race. Bloomsbury.
- ↑ 13.0 13.1 Gallagher, Sean (2019-05-20). "Baltimore ransomware nightmare could last weeks more, with big consequences" (in en-us). https://arstechnica.com/information-technology/2019/05/baltimore-ransomware-nightmare-could-last-weeks-more-with-big-consequences/.
- ↑ Duncan, Ian; Zhang, Christine (2019-05-17). "Analysis of ransomware used in Baltimore attack indicates hackers needed 'unfettered access' to city computers" (in en-US). The Baltimore Sun. https://www.baltimoresun.com/news/maryland/politics/bs-md-ci-ransomware-attack-20190517-story.html.
- ↑ Duncan, Ian. "Home sales are held up; Baltimore ransomware attack cripples systems vital to real estate deals". https://www.baltimoresun.com/news/maryland/baltimore-city/bs-md-ci-ransomware-home-sales-20190514-story.html.
- ↑ Stewart, Emily (2019-05-21). "Hackers have been holding the city of Baltimore's computers hostage for 2 weeks". https://www.vox.com/recode/2019/5/21/18634505/baltimore-ransom-robbinhood-mayor-jack-young-hackers.
- ↑ Lecher, Colin (2019-05-23). "Google shut out Baltimore officials using Gmail after ransomware attack" (in en). https://www.theverge.com/2019/5/23/18637638/google-gmail-baltimore-ransomware-attacks.
- ↑ 18.0 18.1 Duncan, Ian (2019-09-10). "Baltimore IT director who was at helm during ransomware attack and city's recovery is on leave" (in en). https://www.baltimoresun.com/politics/bs-md-ci-frank-johnson-leave-20190910-waliphukdbcg3evzylbrjfefui-story.html.
- ↑ staff, Stephen Babcock / (2020-02-13). "Todd Carter named director of Baltimore City Office of Information and Technology" (in en). https://technical.ly/civic-news/todd-carter-named-director-of-baltimore-city-office-of-information-and-technology/.
External links
- Pirate Party Germany: Hackerangriff auf die Stadtverwaltung von Baltimore: Wie verwundbar sind europäische Städte? June 9, 2019
 |  |
