Baltimore ransomware nightmare could last weeks more, with big consequences

It’s been nearly two weeks since the City of Baltimore’s networks were shut down in response to a ransomware attack, and there’s still no end in sight to the attack’s impact. It may be weeks more before the city’s services return to something resembling normal—manual workarounds are being put in place to handle some services now, but the city’s water billing and other payment systems remain offline, as well as most of the city’s email and much of the government’s phone systems. The ransomware attack came in the midst of a major transition at City Hall.

Mayor Bernard C. “Jack” Young assumed office officially just days before the attack, after the resignation of former mayor Catherine Pugh, who is facing an ever-expanding corruption investigation. And some of the mayor’s critical staff positions remained unfilled—the mayor’s deputy chief of staff for operations, Sheryl Goldstein, starts work today. To top it off, unlike the City of Atlanta—which suffered from a Samsam ransomware attack in March of 2018—Baltimore has no insurance to cover the cost of a cyber attack.

So the cost of cleaning up the RobbinHood ransomware, which will far exceed the approximately $70,000 the ransomware operators demanded, will be borne entirely by Baltimore’s citizens. It’s not like the city wasn’t warned. Baltimore’s information security manager warned of the need for such a policy during budget hearings last year.

But the final budget did not include funds for that policy, nor did it include funding for expanded security training for city employees, or other strategic investments that were part of the mayor’s strategic plan for the city’s information technology infrastructure.

Source: arstechnica.com