The city of Durham, North Carolina temporarily disabled its phone system last weekend after suffering a Ryuk ransomware attack.

The city of Durham and Durham County published a joint statement on March 8 in which they revealed that a malware attack had affected their IT services. According to the statement, the government bodies first learned of the security incident on March 6. Both entities relied on their notification systems to alert IT teams of the attack.

WRAL reported that Ryuk ransomware was responsible for the incident and that it leveraged a malicious email attachment to infect Durham’s IT services.

In an attempt to minimize the damage of the attack, the city of Durham’s IT personnel temporarily disabled the municipality’s phone system. The statement noted that this decision made it difficult for residents of Durham to contact various facilities and services, such as Durham One Call’s phone line, Durham Parks & Recreation centers and City Hall. That being said, IT informed the city that they expected the phone system to become operational again on March 9.

Moreover, Durham’s statement indicated that the malware attack produced little disruption elsewhere for its residents. Officials noted that Durham’s website, for instance, remained fully functional and that residents could use it to pay their water bills and other utilities. The statement also reassured residents that the County’s phone system was operational, its website was functional and that all critical services, including 911 and other public safety agencies, were up and running.

At the time of reporting, IT personnel were in the process of bringing affected systems back online.

Putting the Durham Attack in Context

Durham is not the first municipality that’s suffered a ransomware attack in recent months. Near the end of December 2019, Recorded Future documented the 104th attack of the year in which ransomware actors had targeted state and local governments. This finding highlights the need for local government organizations to better defend themselves against digital threats like ransomware attacks.

The only problem is that taxpayers aren’t always in favor of these changes. In fact, 49 percent of respondents to a survey told Panda Security that they didn’t think government should invest in any additional cybersecurity precautions. A significantly higher proportion of survey respondents (86 percent) went on to say that they didn’t feel their local government should pay the ransom in the event of a ransomware attack, either.

Just the Latest Ryuk Ransomware Attack

Panda Security’s survey findings leave government organizations in a tough spot should they suffer a ransomware infection. That’s especially the case given the ongoing attack activity of Ryuk and other ransomware families. In January 2020, for example, Malwarebytes reported a Ryuk ransomware attack involving the Tampa Bay Times. In the two months since that attack, ransomware has also struck a Florida library system, a council in the United Kingdom, a county government in Illinois and a Fortune 500 company.

How to Defend Against a Ryuk Ransomware Attack

Security professionals can help their organizations better defend against a Ryuk ransomware attack by developing a layered defense strategy. This plan should consist of several parts, including the use of anti-malware tools to spot familiar ransomware families, anti-data encryptors to prevent malware from locking organizations out of their information and anti-spam tools to minimize the risks posed by malicious email attacks.

Security tools only go so far, however, which is why infosec personnel should also use simulated phishing attack exercises to evaluate their workforce’s preparedness against email-based attack campaigns.

Explore the State and Local Government Cyberattacks Timeline

More from

Security Awareness Training 101: Which Employees Need It?

4 min read - To understand why you need cybersecurity awareness training, you must first understand employees' outsized roles in security breaches. “People remain — by far — the weakest link in an organization’s cybersecurity defenses,” noted Verizon on the release of their 2022 Data Breach Investigations Report (DBIR). They elaborate that 25% of all breaches covered in the report were the result of social engineering attacks, and when you add human errors and misuse of privilege, the human element accounts for 82% of…

4 min read

Beyond Requirements: Tapping the Business Potential of Data Governance and Security

3 min read - Doom and gloom. Fear, uncertainty and doubt. The "stick" versus the "carrot". What do these concepts have in common? They have often provided the primary motivation for organizations’ data governance and security strategies. For the enterprise, this mindset has perpetuated the idea that data governance, data security and data privacy are reactive cost centers existing due to externally imposed requirements or mandates. Yet, what if data governance and security practices could upend the prevailing paradigm and demonstrate direct business value?…

3 min read

Protecting Against Remote Monitoring and Management Phishing

3 min read - You use remote monitoring and management (RMM) software to closely monitor your cyber environment and keep your organization safe. But now cyber criminals are specifically targeting these tools, causing legitimate software to become a vulnerability. This is the latest type of attack in an increase in a recent trend of disruptive software supply chain attacks. The Cybersecurity and Infrastructure Security Agency (CISA) recently released an alert about the malicious use of legitimate remote monitoring and management (RMM) software. Last fall,…

3 min read

Secure-by-Design: Which Comes First, Code or Security?

4 min read - For years, developers and IT security teams have been at loggerheads. While developers feel security slows progress, security teams assert that developers sacrifice security priorities in their quest to accelerate production. This disconnect results in flawed software that is vulnerable to attack. While advocates for speed and security clash, consumers must often pay the price when threat actors strike. 48% of developers admitted they were still shipping code with vulnerabilities in 2022. It’s clearly time for a change. Many believe…

4 min read