{"id":13580,"date":"2019-06-28T11:59:13","date_gmt":"2019-06-28T15:59:13","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/encrypted-city-administrations\/13580\/"},"modified":"2019-11-15T15:22:13","modified_gmt":"2019-11-15T11:22:13","slug":"encrypted-city-administrations","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/encrypted-city-administrations\/13580\/","title":{"rendered":"Encrypted cities"},"content":{"rendered":"

The number of cyberattacks on US city administrations is on the rise. In less than two months, a third city suffers from the same threat \u2014 ransomware.<\/p>\n

Baltimore, Maryland, was attacked on May 7<\/a>. The city\u2019s administration decided not to give in to the extortionists and suffered damages of more than $18 million, according to preliminary estimates<\/a>. A few weeks later, Riviera Beach, Florida, was next. The city\u2019s computers were encrypted<\/a>, and officials decided to pay the extortionists 65 bitcoins, or about $600,000.<\/p>\n

A week after that, another city in the same state was attacked<\/a> \u2014 Lake City. This time, the city administration deliberated even less and ended up paying almost half a million dollars to the extortionists. It is not yet known whether they were able to decrypt their data, but they confirmed that the attackers sent them the decryption key.<\/p>\n

This is not the beginning of a new wave of attacks. You don\u2019t have to dig deep to find plenty of other similar, prominent incidents \u2014 in Atlanta, Georgia<\/a>, Jackson County, Georgia<\/a>, Albany, New York<\/a>, and more.<\/p>\n

To pay or not to pay?<\/h2>\n

As the Baltimore case shows, it is much more expensive to fight the consequences of an attack than to pay extortionists. Perhaps it was the calculation of the damages from this incident that influenced the decisions of the Riviera Beach and Lake City councils.<\/p>\n

Of course, the decision to pay is understandable. When ransomware paralyzes city services, we are talking not only about financial damages, but also about the lives and well-being of local residents. However, every time a city pays, attackers become more convinced that their efforts are not in vain. So, they choose their next victim and keep the trend going. That\u2019s a big part of why the FBI and companies involved in information security do not recommend paying.<\/p>\n\n

How to avoid getting encrypted<\/h2>\n

Almost all ransomware infections follow a similar script: Someone in a city\u2019s administration receives a letter that includes a malware link or attachment and, not recognizing the threat, the employee launches the malware, which exploits long-known vulnerabilities in operating systems or other software to encrypt data. Sometimes (again, through known vulnerabilities), the malware spreads to all computers on the victim\u2019s local network. Therefore, we have three main tips:<\/p>\n