CAMDEN COUNTY, Mo. — On April 9, 2020, Camden County learned it was the victim of a cyber-attack. The county got hacked.

County officials have been mum on details, saying the investigation is ongoing. But on Friday, April 17, the county gave a small indication that it may have been the victim of ransomware: in which a hacker is holding county files hostage.

The county stated the following in a press release on April 17:

As previously reported, on April 9, 2020, Camden County learned that it was the victim of a sophisticated encryption attack believed to have been caused by external, malicious actors attempting to disrupt the operations of the County.  While the threat actors were able to encrypt certain files within Camden County’s network, the County is working closely with independent cybersecurity experts to identify the scope of the attack and repair any damage to its data. At this time, the County is not aware of any unauthorized disclosure of personal data or financial information.

Although ransomware has not been explicitly mentioned yet in the recent breach at the Camden County Courthouse, their law firm initially stated the county was a “victim of a sophisticated encryption attack, which is currently disrupting operations.” Both encryption and disruption are typical goals for a ransomware attack, which can encrypt almost all data files, including documents, pictures, financial information, and in the case of a government system, publicly available records.

In ransomware attacks, cybercriminals encrypt or “lock” the data files, at times even infecting the servers that house large amounts of data. They will only release the “keys” to unlock those files if a ransom is paid, typically in Bitcoin, which is difficult to trace. In the meantime, the victim cannot access those files, and even if backups can be restored, the process can take days for the system to be fully functional again. Part of that process is to secure all the computers to make sure that the methods of accessing those devices have been removed or blocked. Also, if any Personally Identifiable Information (PII) is stored on the infected system, a forensic investigation should take place to confirm that none of that data, which could be used for identity theft and other fraud, has been removed from the computers.

The county's current wording is key, too: they stated they were "not aware of any unauthorized disclosure of personal data or financial information." This is crucially different from saying they are certain there was no unauthorized disclosure of that information. The extent of the breach has not been made known to the public, yet, and the county has said no further details will be provided at this time.

0
0
0
2
7

(0 Ratings)