An unknown external party attempted to gain access to and encrypt files in the City of Richardson’s servers Sept. 25 in a classic case of a ransomware attack. Richardson officials are investigating the attack, including what specific data accessed before the network security systems prevented further breach.
UTD computer science professor Kevin Hamlen said ransomware attacks involve an attacker making the victim’s data unreadable through encryption and holding it hostage until payment is provided, leading to financial loss and compromising sensitive information. Cities like Richardson often host critical data on their municipal servers, such as personal details of residents, property ownership records, tax payments, utility accounts and city management data such as law enforcement records. Had such data been hacked into and encrypted, the ransomware attack would become a significant threat to the city’s infrastructure and the safety of its residents.
“[Hackers] encrypt files that are valuable to the victim, and what that means is that it’s transforming the file into something that’s unreadable by the victim,” Hamlen said. “But if the victim only knew a certain secret key, he or she would be able to transform that encrypted file back into the original file and get it back. Then the attacker demands a payment of some kind in order to release the secret key in order to get all the files back, and the value of encrypting them all is that now the attacker doesn’t actually have to make off with those files.”
Currently, Richardson is unable to specify the type of data that was encrypted as investigation continues. However, there are currently no signs that any sensitive data was breached. According to city officials, essential services such as emergency response, online payments and other customer portals are still functioning, while access to internal systems, such as city documents and records, is limited. The city is cooperating with the Department of Homeland Security and the FBI to identify those responsible and to further protect the data in the servers. Hamlen said it seemed Richardson’s cyberattack detection systems, which stopped the ransomware attack partway through, had successfully performed their jobs.
Because the attack only targeted Richardson’s municipal servers, none of UTD’s infrastructure or private data was affected. However, any individual or institution could experience a cybersecurity breach at any time. Celina Rodriguez, a computer science sophomore and logistics officer for Women in Cybersecurity at UTD, said the majority of cybersecurity attacks stem from human error.
“This is where social engineering comes in,” Rodriguez said. “If you’ve heard of phishing attacks, you get sent an email and [if] you don’t look at it too closely and just click on a link, suddenly there’s malware on your computer. This is one of those entry points where you find that your data can suddenly become insecure.”
Although cybersecurity attacks are becoming more common, they are certainly not a new phenomenon and have a long history of damage. For example, the 2017 Petya malware attack in Ukraine initially targeted Ukrainian banks, government agencies and companies and eventually affected companies on a global scale, damaging the nation’s infrastructure. The malware was discovered to be a wiper attack, a malware designed to corrupt data instead of utilizing it for monetary gain. Kristine Thomas, software engineering senior and president of Women in Cybersecurity, said that as cybersecurity experts develop countermeasures, new methods of attack continue developing as well.
“We might have cybersecurity and defenses in place that are broad because we don’t really know what vectors the attackers are going to take,” Thomas said. “It’s always going to be that sort of rat race of trying to predict how we are going to be attacked and then building measures in place.”
Beyond government-scale attacks, private individuals are also at risk of experiencing a cybersecurity attack and having their sensitive information, such as bank account details, social security numbers and passwords, stolen. Adopting techniques like using strong passwords or regularly updating software can significantly minimize the risk of encountering a cybersecurity breach. Multiple student organizations on campus, including Women in Cybersecurity, host events focusing on the importance of cybersecurity and offer tips on how to maintain a safe digital footprint.
“I think just a little diligence … goes a long way,” Thomas said. “Either joining cybersecurity-related clubs or just turning off your cookies or getting a privacy extension, password managers, things like that, takes [only] a little more time out of your day.”