[BreachExchange] Knoxville Pulls IT Systems Offline Following Ransomware Attack

[Destry Winant]

https://www.darkreading.com/attacks-breaches/knoxville-pulls-it-systems-offline-following-ransomware-attack/d/d-id/1338081

Knoxville's government took its network offline and turned off
infected servers and workstations after a ransomware attack this week.

A ransomware attack this week forced the government of Knoxville,
Tenn., to shut down its servers, Internet connections, and computers.
City officials say no personal information was compromised in the
incident.

The attack took place overnight on Thursday, June 11, and was first
detected by member of the Knoxville Fire Department around 4:30 a.m.,
according to the Knoxville News Sentinel. Shortly after the discovery,
chief operations officer David Brace sent an email alerting city
employees to the attack.

"Please be advised that our network has been attacked with
ransomware," Brace wrote. "Information Systems is currently following
recommended protocols. This includes shutting down servers, our
internet connections, and PCs. Please do not log in to the network or
use computer applications at this time," CBS affiliate WVLT reported.

The city's IT team worked to shut down Knoxville's computer network,
identify problems, and minimize damage, a spokesperson told WVLT.
Parts of the city's website were offline Thursday, but Brace said
public safety organizations, including fire and police departments,
weren't compromised. Forensic and risk experts are working to resolve
the issue, which has been reported to the FBI and federal government
security teams, he said. The city is working with the Tennessee Bureau
of Investigation.

So far, officials confirm city servers were affected but believe the
attack is isolated. No backup servers were hit, Brace said, and the
city's work can be rerouted through those. They believe the attack
took place because an employee opened a phishing email, though this
has not yet been confirmed.

With this incident, Knoxville becomes the latest in the string of US
municipalities to face ransomware. Attackers have previously targeted
Baltimore, Atlanta, Palm Beach, Fla., and New Orleans.