The city of Durham, North Carolina temporarily disabled its phone system last weekend after suffering a Ryuk ransomware attack.

The city of Durham and Durham County published a joint statement on March 8 in which they revealed that a malware attack had affected their IT services. According to the statement, the government bodies first learned of the security incident on March 6. Both entities relied on their notification systems to alert IT teams of the attack.

WRAL reported that Ryuk ransomware was responsible for the incident and that it leveraged a malicious email attachment to infect Durham’s IT services.

In an attempt to minimize the damage of the attack, the city of Durham’s IT personnel temporarily disabled the municipality’s phone system. The statement noted that this decision made it difficult for residents of Durham to contact various facilities and services, such as Durham One Call’s phone line, Durham Parks & Recreation centers and City Hall. That being said, IT informed the city that they expected the phone system to become operational again on March 9.

Moreover, Durham’s statement indicated that the malware attack produced little disruption elsewhere for its residents. Officials noted that Durham’s website, for instance, remained fully functional and that residents could use it to pay their water bills and other utilities. The statement also reassured residents that the County’s phone system was operational, its website was functional and that all critical services, including 911 and other public safety agencies, were up and running.

At the time of reporting, IT personnel were in the process of bringing affected systems back online.

Putting the Durham Attack in Context

Durham is not the first municipality that’s suffered a ransomware attack in recent months. Near the end of December 2019, Recorded Future documented the 104th attack of the year in which ransomware actors had targeted state and local governments. This finding highlights the need for local government organizations to better defend themselves against digital threats like ransomware attacks.

The only problem is that taxpayers aren’t always in favor of these changes. In fact, 49 percent of respondents to a survey told Panda Security that they didn’t think government should invest in any additional cybersecurity precautions. A significantly higher proportion of survey respondents (86 percent) went on to say that they didn’t feel their local government should pay the ransom in the event of a ransomware attack, either.

Just the Latest Ryuk Ransomware Attack

Panda Security’s survey findings leave government organizations in a tough spot should they suffer a ransomware infection. That’s especially the case given the ongoing attack activity of Ryuk and other ransomware families. In January 2020, for example, Malwarebytes reported a Ryuk ransomware attack involving the Tampa Bay Times. In the two months since that attack, ransomware has also struck a Florida library system, a council in the United Kingdom, a county government in Illinois and a Fortune 500 company.

How to Defend Against a Ryuk Ransomware Attack

Security professionals can help their organizations better defend against a Ryuk ransomware attack by developing a layered defense strategy. This plan should consist of several parts, including the use of anti-malware tools to spot familiar ransomware families, anti-data encryptors to prevent malware from locking organizations out of their information and anti-spam tools to minimize the risks posed by malicious email attacks.

Security tools only go so far, however, which is why infosec personnel should also use simulated phishing attack exercises to evaluate their workforce’s preparedness against email-based attack campaigns.