City of Sammamish’s computer system under ransomware attack

The City of Sammamish’s computer system came under a ransomware attack Wednesday morning, prompting the city manager to declare an emergency. A hacker is preventing access to computers unless the city pays a ransom.

“Yesterday morning, it was discovered that a hack had occurred,” said Sammamish Mayor Christie Malchow. “It’s considered ransomware because there was a request for money to release records for the city. The city doesn’t have any intention to pay that.”

Mayor Malchow said the city won’t pay the ransom because there is nothing to guarantee the records will be released.

The city’s computer system is under a ransomware attack. We are bringing in a security expert to assist the city with assessing which systems have been affected and to what extent.

We are committed to keeping you informed throughout our response to the situation.

— City of Sammamish (@CityofSammamish) January 24, 2019

Sammamish City Manager Larry Patterson has $50,000 he can spend on his own at a moment’s notice. He has to ask the city council to spend more money. But the council doesn’t have a meeting soon enough. So he declared the emergency Wednesday to free up funds to deal with the ransomware.

So far, the city has hired a third-party cyber security expert to handle the situation. Mayor Malchow said that it is unclear when the city will regain access to its computers, or if it will lose any files because of the attack.

“We don’t know … what systems have been affected or how deep the penetration into the city’s files it went…” she said. “They shut everything down. I don’t know when it will be back up.”

Sammamish attack

Officials said that as of 6 p.m. Wednesday, the city’s internally-shared files had been affected. KIRO 7’s Gary Horcher reports that city computers can hold a range of data from tax records to police files and building permits. Mayor Malchow also said that employee records are another consideration.

Passport services were closed at the city Wednesday because of the hack. Appointments requiring access to computer files, such as a building permit application, are also on hold. City employees are still going to work. A lot of work is being done on paper. Sammamish’s website has not been affected and is up and running.

City officials said the security expert will assist the city with:

• Assessing which systems have been affected.
• The level of penetration.
• What will be required to release the data.

The city is working on two fronts: dealing with the attack itself; and implementing business continuity measures. Officials said the city has taken down MyBuildingPermit and map services as a precaution to protect residents and businesses.

Ransomware

Ransomware is a form of cyber attack. A hacker gains access to a computer, or a computer system, an prevents all access. They will only release access to the computers when a ransom is paid. The only other option would be erasing the computer and re-programing it from scratch, losing all data. Hackers often gain access to computers by sending an email that, if opened, will release malicious code to lock down the computer. According to the FBI, ransomware is one of the fastest growing online threats.

A similar attack on the City of Atlanta in 2018 cost that city $2.6 million in costs relating to dealing with the hackers — incident response, online security, forensics, and extra staffing. Atlanta opted not to pay the initial $50,000 ransom demanded by the cyber attackers.

MyNorthwest, KIRO 7, and KIRO Radio contributed to this article.

Follow @http://twitter.com/Mynorthwest