What Happened?
Cleveland Municipal Court has been shut down the past two weeks as it grapples with a cyber incident. The nature and scope of this incident is not yet publicly known, but it is reasonable to suggest that the Court may have been hit with a ransomware attack. Last year, both the cities of Cleveland and Columbus were hit with ransomware attacks, and cyber criminals have been attacking municipal governments throughout the United States with ransomware attacks.
Cleveland Municipal Court, which handles lower-level criminal and civil cases, first noticed that something was wrong during the weekend of February 22 and was forced to shut down nearly all operations. This past week, Governor DeWine ordered the Ohio National Guard’s Cyber Reserve Force to assist the Court in resolving the incident.
Based on comments from Court staff and the length of the Court’s closure, it appears that the incident is serious and widespread. A spokesperson for the Court told the media that “[a]ll internal systems and software platforms will be shut down until further notice[.]” Again, this follows a ransomware attack that closed Cleveland City Hall for almost two weeks last year. The nature and extent of that earlier attack was not completely revealed until sometime later.
What is a Ransomware Attack?
According to the National Institute of Standards and Technology:
“[R]ansomware is a type of malware that encrypts an organization’s data and demands payment as a condition of restoring access to that data. Ransomware can also be used to steal an organization’s information and demand additional payment in return for not disclosing the information to authorities, competitors, or the public. Ransomware attacks target the organization’s data or critical infrastructure, disrupting or halting operations and posing a dilemma for management: pay the ransom and hope that the attackers keep their word about restoring access and not disclosing data, or do not pay the ransom and attempt to restore operations themselves.”
What sets ransomware attacks apart from other cyberattacks is that the ransomware attackers want victims to know what they have done and what information they have taken. Their goal is to hold private information hostage in exchange for money. Other cybercriminals may not even want you to know your information has been compromised so that they can use your information without you knowing.
If the Cleveland Municipal Court incident is, in fact, a ransomware attack, then it is possible that cyber criminals have gained access to private information belonging to the Court’s employees or even sealed confidential information of parties involved in lawsuits.
KJK will follow this cyber incident and keep you informed of major developments. If you have any questions or would like to discuss further, please contact KJK Cyber Security & Data Breach attorney Michael Hoenig (MDH@kjk.com).