(Credit: Sean Pavone via Getty)
A ransomware attack has forced the city government of Wichita, Kansas, to pull some services offline as it tries to contain the infection.
On Sunday, Wichita’s city government reported the ransomware incident, which was found encrypting data for certain city systems. “As part of this assessment, we turned off our computer network,” the city told residents on its website.
Although the city’s main website is live, other services that let residents make payments or view court records appear to be offline. The city is declining to name the ransomware group involved, citing “operational security purposes.” But it’s confirmed that the attack focused on encrypting files, with the goal of pressuring the city to pay a ransom.
A key concern is whether the hackers stole sensitive data from Wichita, a city home to 400,000 people. Ransomware groups often loot such information and threaten to sell or leak it in order to pressure victims to give into their demands. This worked on insurance provider UnitedHealth Group, which recently confirmed it paid a reported $22 million to mitigate a ransomware attack.
It's unclear if Wichita will do the same. For now, it's "completing a thorough review and assessment of this matter, including the potential impact on data, [which will] take time.” Federal investigators and law enforcement have been called in to assist.
The city also says it’s taking a careful approach with restoring services. “We are working with specialists to thoroughly review and assess systems before putting them back online,” Wichita said. “Systems will be restored on a staggered basis to minimize disruptions. We do not have a definitive timeline for returning all systems to production.”
The attack marks the 36th time ransomware has hit a local government in the US, according to cybersecurity company Emsisoft, another sign that the ransomware threat continues to rage unabated.