Johnson City suffers apparent ransomeware attack

Johnson City Press • Oct 21, 2019 at 6:58 PM

Johnson City’s government is recovering from what it described as an apparent ransomware attack early Monday morning.

The city said in a news release that a note left by the hackers did not demand money, but indicated some city files had been locked and told users to contact them regarding their release. The city said staff did not engage the hackers.

Staff were asked to shut down computers Monday morning while the issue was identified and resolved. The city said some transactions typically completed electronically were conducted via paper, and phone systems were not affected.

"We have contingencies in place to ensure business continuity," Lisa Sagona, the city’s informational technology director, said in the release, "While a breach is the last thing we would ever want, we were prepared and able to mitigate the impact on City operations."

The city said in the release that data has been restored, and city spokesperson Ann Marie French said no information was compromised. She said the city is working to bring its systems back online slowly to ensure everything is operating as it should following the hack.

Sagona said in the release that the Johnson City Commission recently invested in a hyperconverged storage area network, which became operational three weeks ago. She said that has enabled the city to restore files in half a day rather than several days.

“We also were able to fully restore as opposed to losing more than a week's worth of information from a less sophisticated type of backup," Sagona said.

Michael Mingle, a senior systems engineer with BCTI, which provides technology support to the city, said in the release that it is “highly unlikely” that the hackers obtained actual data.

"In 99 percent of these types of attacks, they are looking for ransom money, not information,” Mingle said in the release. “In our service area alone, we are seeing about one to two of these a month."