Dallas confirms sensitive data was stolen in recent ransomware attack
The City of Dallas, Texas, confirmed on Thursday that files potentially containing sensitive information were accessed by an unauthorized third party during a ransomware incident this past May that affected several city services.
The city said Thursday it’s determined that files were downloaded sometime between April 7 and May 4. According to a city news release, the files included sensitive information such as full names, home addresses, Social Security numbers, dates of birth and health and insurance data.
A ransomware group known as Royal claimed responsibility for the Dallas cyberattack, which temporarily took down the city’s main website and the Dallas Police Department website and disabled the city’s 911 computer-aided dispatch system. The incident also caused the city courts to close and took down Dallas Public Library’s online catalog, which is now back online.
Royal, which is an offshoot of the Conti ransomware gang, threatened on May 19 to publish data stolen from Dallas — including “tons of personal information of employees (phones, addresses, credit cards, SSNs, passports)” — if a ransom was not paid. Royal did not specify a ransom amount, and by June 7, city officials reported that 90% of the systems damaged by the attack had been recovered.
While Dallas officials said they were unaware of any identity theft or fraud resulting from the May cyberattack, the city will provide affected individuals with two years of free credit monitoring and identity-theft-protection service. The city said it’s notifying those affected and encouraged them to monitor their financial statements and credit reports.
In June, Dallas City Council authorized the city’s Department of Information and Technology Services to spend nearly $4 million on a network threat and anomaly system. It awarded a three-year contract to Netsync, a Houston IT firm.
“The privacy and security of the information the City maintains is of the utmost importance and the City sincerely regrets any inconvenience or concern this incident may have caused,” the news release reads.
