Rewterz Threat Update – Oakland Declares A Local State Of Emergency After A Ransomware Attack

Severity

High

Analysis Summary

Oakland declared a local state of emergency on February 8th due to the impact of a ransomware attack that forced the City to take all its IT systems offline. Interim City Administrator G. Harold Duffey declared a state of emergency, allowing the City of Oakland to expedite orders, materials, and equipment procurement, and to activate emergency workers when needed. 

“Today, Interim City Administrator, G. Harold Duffey issued a local state of emergency due to the ongoing impacts of the network outages resulting from the ransomware attack that began on Wednesday, February 8.” according to a statement issued today

source

The Information Technology Department alerted local authorities and began an investigation to ascertain the magnitude and extent of the issue.

The attack did not affect core services, with the 911 dispatch and fire and emergency resources all working as expected. Microsoft also announced in January that it is currently tracking over 100 ransomware gangs that were known to have deployed over 50 distinct malware families up until the end of the previous year. As a result, the City of Oakland declared a state of emergency one week after the incident to contain the threat and seek state and federal funds to cover the recovery costs associated with the attack.

The ransomware family that targeted the City’s infrastructure has not yet been identified. The IT Department has engaged additional cybersecurity and technology firms to assist with rescue operations and is working with a top forensics company to investigate the incident. The investigation is still underway.

“The City’s IT Department is working with a leading forensics firm to perform extensive incident response and analysis” and “This continues to be an ongoing investigation with multiple local, state, and federal agencies involved,” they conclude.

Impact

• Network Outages 

Remediation

• To mitigate the risk of future attacks, the city is taking steps to strengthen its security posture. These measures include blocking common entry points, using endpoint security software, and monitoring for unusual activity.
• Additionally, the city is working with federal and state authorities to investigate the incident and restore its systems.
• In the meantime, city employees are still receiving their wages, and residents can still call 9-11 in the event of an emergency.