[BreachExchange] Woodstock city, police targeted by 'cyber attack'

[Destry Winant]

https://www.woodstocksentinelreview.com/news/local-news/city-of-woodstock-experiencing-cyber-attack

The City of Woodstock and the Woodstock Police Service are both
currently suffering cyber attacks.

Woodstock’s top administrator, David Creery, confirmed the city had a
network breach early Saturday morning around 4 a.m. when a virus
entered its computer system. That virus has since prevented the city
from accessing its email and data networks.

Creery said the city has engaged experts and police in its
investigation, including the Woodstock Police Service and the OPP
cyber-crimes unit.

The attack “has the appearance” of aransomware, though no formal
ransom demand has been made, Creery added.

Ransomware is a type of malicious computer program that denies access
to the system or its data until a ransom is paid. If that ransom is
paid, the hacker then provides a key or password that unlocks the
data.

The Woodstock Police Service is also experiencing a separate attack
that started around 2:30 a.m. Monday morning, Insp. Marci Shelton
said, but have not indicated whether it is ransomware.

Police are continuing operations largely as normal and police response
is not impacted, Shelton stressed. The department’s email and internet
networks are down, so residents cannot use online reporting tools or
Facebook Messenger, but otherwise response and reporting continue as
usual. Residents should call the station if they need police or dial
911 in emergencies.

Through expert examination of the city networks, Creery said there is
no indication that any personal or financial information has been
compromised. Shelton said there is no indication of personal or
financial information being stolen from police either.

The city is currently in the process of minimizing the impact and
resolving the attack, including containing the city’s network and
using experts to examine the city’s computers to determine how, when
and why the attack occurred. Creery said the city hopes to begin
recovery of its systems later Tuesday.

Woodstock police are working with the OPP cyber-crimes unit, as well
as its own investigators, IT staff and a third-party company to
resolve its cyber attack, Shelton said.

The City of Stratford experienced a similar attack in April and, last
week, officials revealed they had paid a hacker the equivalent of
$75,000 in Bitcoin. The attack crippled the city’s computer system,
though the city later said there was no evidence of data theft
following the attack.

Carmi Levy, a London-based tech analyst, said these kinds of attacks
are becoming increasingly common.

“The fact that you have two significant high-profile ransomeware
attacks relatively close together … confirms that this is a major
issue and it is getting worse,” Levy said.

But the very last thing cities should do if experiencing a ransomeware
attack is pay, Levy added.

“In some cases, the hackers could simply take the money and run. …
Even if they do unlock your data and allow you to regain access to
what was lost, the fact that you elected to pay makes you more likely
to be attacked in future,” Levy said.

Payment amounts to a “feeding frenzy among sharks,” Levy added.
Hackers will be more likely to target you in future, and it sets a
dangerous precedent for all hackers looking at cities as potential
targets.

Though he’s not involved in Woodstock’s response to this attack, Levy
said a ransomware victim would typically be restoring backup data,
reinstalling operating systems and apps, and rebuilding its
infrastructure, essentially from scratch.

If the city was well-prepared, that would allow the city to come back
“like the attack never happened” without paying a ransom – saving the
city a lot of money and aggravation, Levy said.

The city’s email system is currently down, the statement noted, but
residents can continue to call city hall and all third-party systems,
such as the city’s website and registration for recreation programs,
are running as normal.

What you need to know: City of Woodstock cyber attack

Q: What is ransomware and what is its goal? Why is it different from
other types of cyber attacks?

Ransomware isn’t about stealing data, unlike other types of attacks
that take data and sell it on the black market, Levy said. Ransomware
freezes or locks a victim’s access to their own information, holding
it hostage until a ransom is paid.

“Data does not have to be stolen in order for an attack to be
damaging. Lack of access to your data or critical systems can be just
as damaging to your business, and if you are a civic administration,
you don’t have to lose data in order to suffer a very expensive loss,”
Levy said.

Q: How do cyber attacks happen?

Most often, through human error, Levy said, although cause hasn’t been
made public in these Southwestern Ontario cyber attacks, including a
similar attack in Stratford this spring.

“An employee or contractor, someone connected to the victim, opening
an email with a link or button in it. It is not legitimate but looks
legitimate,” Levy said. That starts the attack.

Q: If you were attacked, should you pay the ransom to get access to your data?

Simply put, no.

Levy said that not only does paying a ransom cost you, literally, it
doesn’t mean it will resolve the issue. The hackers can always take
the money and run without freeing your data, Levy said. But if you pay
this time, it makes you a target in future.

“The criminal hacking community always looks for the weakest link,” he said.

Q: What is the appeal in going after a municipality if you’re not
stealing personal information?

First, Levy said cities and civic administrations are high-profile targets.

“In the criminal hacking community, attention is currency. The bigger
the victim, the more notorious you (as a hacker) are,” Levy said.

And then there’s the money: Cities have it and, by hitting a target
that has money, hackers up the likelihood of a payout.

Q: Are these types of cyber attacks a trend, and how much of a threat are they?

Yes, it’s a trend, and municipalities should be worried, Levy said.
Generally speaking, they’re woefully underprepared to respond.

“Over the past few years, ransomware has become the number one cyber
security threat to all of us and the situation continues to worsen,”
Levy said.