Madison County Servers - HELD RANSOM

[Palehorse]

Any update on this story?  Are the servers back and operational?

No updates today. Pushed to the back burner, way back burner, by the election caterwauling. 

[Palehorse]

Found this:

ANDERSON – Madison County officials are in the process of removing the ransomware attack from the county's computer servers after payment of a ransom to the hackers.

Lisa Cannon, director of the IT Department, said Wednesday that the county has obtained the keys to remove the encryption from the servers so that officials can have access to data.

She said her staff is working on taxes and billing and public safety.

"It's a slow process," Cannon said. "There are a lot of variables involved."

Informed county sources, who didn't want to be named, indicated the ransom paid by Madison County was $28,000. It was paid on the advice of the county's insurance carrier, Travelers Insurance.

Cannon informed the Madison County Council at Wednesday's meeting that she will be spending money that is not in her budget over the next month.

"It has been a devastating last few days," she said. "We can't do without any longer."

Cannon said the council eliminated six positions in the department in 2012 and reduced the budget by 56 percent.

"We can't be expected to operate as large as General Motors on a gas station budget," she said. "We need help and it's going to take funds."

Cannon said it will cost the county $17,500 to bring in a support company to bring the two largest computer servers back online and to make best practices recommendations.

"This is a drastic situation and we need a council that will support us, so we can serve the employees so they can serve the public," she said.

One of the options being considered is to store the county's computer data off-site to protect the county from future attacks.

Cannon said the ransomware attack affected 600 personal computers and up to 75 servers.

"We can't wait to take action," she said. "We have to have bodies and finances. We can't operate the IT Department on a shoestring budget."

Council President Fred Reese asked Cannon to bring a plan to the council at the December meeting.

Indiana State Police Capt. Dave Bursten said the investigation is ongoing.

"Investigations of this nature are complicated, are rarely solved, and typically involve criminal actors from foreign countries," he said.

Bursten said the best defense to malware attacks is daily backups to segregated backup sources or to third party backup vendors not on the same system. He said internal backups that are not segregated offer no protection to ransomware attacks

Concerning the payment of a ransom, Bursten said ISP concentrates on the criminal aspect of the investigation and makes no recommendation related to the payment or non-payment of ransom.

"Decisions to pay or not pay a ransom are business decisions," he said.

Ransomware is a type of malicious software that prevents access to computers by its rightful users through file encryption until a specified amount of money is paid.

[me]

I'm glad to know they at least got the keys.

[Locutus]

Did they ever get things restored?

[Palehorse]

Did they ever get things restored?

Unknown. They coughed up 20k to get the key(s) though.

[Locutus]

That's a lot of money.  Most of the time, at least in instances I've seen, it's only been a few hundred dollars. 

[Y]

Last I heard on the television news is that they paid 30k ransom.  Also, obviously, the rumor about Jeff Hardin tracking them down and arresting them was NOT true.

[Locutus]

LOL!!

Who is Jeff Hardin?

[Y]

A Madison County Commissioner - he was running for re-election - and former APD officer and MCSD deputy.

He's also a somewhat noted bluegrass musician.

[Locutus]

Well those ransomware people are usually international, use TOR for masking their IPs, and are paid in bitcoins.  It would be very difficult for some local yokel LEO to track them down. 

[Y]

Of course it is, but that's how rumors go in this podunk town.  It wouldn't surprise me if that rumor wasn't started to sway an election.   

At least the FBI wasn't involved in this rumor.   

[Palehorse]

Last I heard on the television news is that they paid 30k ransom.  Also, obviously, the rumor about Jeff Hardin tracking them down and arresting them was NOT true.

Actually, the amount I hear they actually paid was 28k. . . And my source is a city council-member. . .

[me]

Last I heard on the television news is that they paid 30k ransom.  Also, obviously, the rumor about Jeff Hardin tracking them down and arresting them was NOT true.

I didn't think so but it was, after all, his daughter who posted that.... 

[Palehorse]

http://www.wthr.com/article/central-indiana-county-restoring-hacked-computer-system

Apparently they are STILL working on restoring the systems despite having the keys and paying the ransom for them.

[Palehorse]

http://www.wthr.com/article/central-indiana-county-restoring-hacked-computer-system

Apparently they are STILL working on restoring the systems despite having the keys and paying the ransom for them.

And the costs keep mounting over this incident, with an article in todays paper Indicating that the town has spent $200k thus far over it; and they still aren't back to normal yet!