Business

North Carolina County Refuses Ransom Demand

Share
Security Breach

Diorio also says that it would still have taken days to fix the system even after paying the ransom, and it won't take much longer to rebuild it without cooperating with the criminals. After the attack, the county disconnected most computer applications.

County officials are trying to decide whether to pay the ransom or begin what could be a lengthy process of restoring the servers from backups.

An expert on cyber security told The Associated Press that it's not uncommon for municipalities to be hacked with ransomware. Diorio said officials believe the hackers are from Iran or Ukraine.

At this point, officials don't believe any information has been stolen, but malware was discovered on about 30 servers.

On Tuesday night, Diorio said the hacker was demanding two bitcoins, which amounts to $23,000, by 1:00 p.m. Wednesday. Not paying and instead rebuilding applications could take longer still, she added. Describing county services, she said: "We are slower, but we are up and running".

"You're taking a risk when you do that", he said. Hackers were able to freeze servers that prevented county officials from accessing information stored on them.

"Our priorities are going to be systems that affect health and human services, like the Department of Social Services, Health Services, Child Support Services", Diehl said. The city released a statement Wednesday that its separate computer systems have not been affected and that it has severed direct connections to county computers.

Population numbers for Mecklenburg County jails are expected to rise, the county said on its website, because the inmate releases have to be handled manually and the entire process is significantly slowed down.

Charlotte CIO Jeff Stovall said the city is always vigilant but has increased its monitoring of "any activities that are happening on our networks and on our devices", and sent out reminders to staff of the proper handling procedures for emails and attachments.

But WBTV has learned the demand is for "substantially" more than that, according to a county official with knowledge of the ongoing efforts to retrieve the county's data who asked not to be identified in order to provide details of the ongoing internal county discussions.

"I wouldn't say that this particular incident is unusual in the operation of any large enterprise".

Share