March 10, 2020 By David Bisson 2 min read

The city of Durham, North Carolina temporarily disabled its phone system last weekend after suffering a Ryuk ransomware attack.

The city of Durham and Durham County published a joint statement on March 8 in which they revealed that a malware attack had affected their IT services. According to the statement, the government bodies first learned of the security incident on March 6. Both entities relied on their notification systems to alert IT teams of the attack.

WRAL reported that Ryuk ransomware was responsible for the incident and that it leveraged a malicious email attachment to infect Durham’s IT services.

In an attempt to minimize the damage of the attack, the city of Durham’s IT personnel temporarily disabled the municipality’s phone system. The statement noted that this decision made it difficult for residents of Durham to contact various facilities and services, such as Durham One Call’s phone line, Durham Parks & Recreation centers and City Hall. That being said, IT informed the city that they expected the phone system to become operational again on March 9.

Moreover, Durham’s statement indicated that the malware attack produced little disruption elsewhere for its residents. Officials noted that Durham’s website, for instance, remained fully functional and that residents could use it to pay their water bills and other utilities. The statement also reassured residents that the County’s phone system was operational, its website was functional and that all critical services, including 911 and other public safety agencies, were up and running.

At the time of reporting, IT personnel were in the process of bringing affected systems back online.

Putting the Durham Attack in Context

Durham is not the first municipality that’s suffered a ransomware attack in recent months. Near the end of December 2019, Recorded Future documented the 104th attack of the year in which ransomware actors had targeted state and local governments. This finding highlights the need for local government organizations to better defend themselves against digital threats like ransomware attacks.

The only problem is that taxpayers aren’t always in favor of these changes. In fact, 49 percent of respondents to a survey told Panda Security that they didn’t think government should invest in any additional cybersecurity precautions. A significantly higher proportion of survey respondents (86 percent) went on to say that they didn’t feel their local government should pay the ransom in the event of a ransomware attack, either.

Just the Latest Ryuk Ransomware Attack

Panda Security’s survey findings leave government organizations in a tough spot should they suffer a ransomware infection. That’s especially the case given the ongoing attack activity of Ryuk and other ransomware families. In January 2020, for example, Malwarebytes reported a Ryuk ransomware attack involving the Tampa Bay Times. In the two months since that attack, ransomware has also struck a Florida library system, a council in the United Kingdom, a county government in Illinois and a Fortune 500 company.

How to Defend Against a Ryuk Ransomware Attack

Security professionals can help their organizations better defend against a Ryuk ransomware attack by developing a layered defense strategy. This plan should consist of several parts, including the use of anti-malware tools to spot familiar ransomware families, anti-data encryptors to prevent malware from locking organizations out of their information and anti-spam tools to minimize the risks posed by malicious email attacks.

Security tools only go so far, however, which is why infosec personnel should also use simulated phishing attack exercises to evaluate their workforce’s preparedness against email-based attack campaigns.

Explore the State and Local Government Cyberattacks Timeline

More from

ONCD releases 2024 Report on the Cybersecurity Posture of the U.S.

4 min read - On May 7, the Office of the National Cyber Director (ONCD) released the 2024 Report on the Cybersecurity Posture of the United States. This new document is a report card on how well cyber policy followed the guidelines set by the National Cybersecurity Strategy, introduced in March 2023. Here’s what you need to know about the newly released report. Fundamental shifts in cyber roles Over the past year, the U.S. national cybersecurity posture was driven by the 2023 National Cybersecurity…

CISA wants private industry to publicly commit to Secure by Design

4 min read - The tech industry has the power to protect the world from nation-state threat attacks, cyber crime and those wanting to compromise data and manipulate critical infrastructure. But with this power comes great responsibility, which, to be honest, the tech industry has not been that interested in holding. But at the RSA Conference (RSAC) in San Francisco, the cybersecurity and tech communities took steps to exert some power and take responsibility. They took the Secure by Design pledge, a promise to…

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today