A hacker\u2019s attack slowed county government to a crawl Wednesday in North Carolina\u2019s most populous metro area as deputies processed jail inmates by hand, the tax office turned away electronic payments and building code inspectors switched to paper records.<\/p>\n\n\n\n
Data was frozen on dozens of Mecklenburg County servers after one of its employees opened an email attachment carrying malicious software earlier this week. The hacker responsible \u2014 believed to be in Ukraine or Iran \u2014 has demanded more than $23,000 to restore access.<\/p>\n\n\n\n
County manager Dena Diorio said officials still hadn\u2019t decided Wednesday afternoon if they will pay the ransom, and it will take days to restore the county\u2019s computer system whether or not they do.<\/p>\n\n\n\n
\u201cIf we don\u2019t pay, we have to rebuild our applications from scratch,\u201d Diorio said.<\/p>\n\n\n\n
In the meantime, county departments were scrambling to conduct business without access to digital records.<\/p>\n\n\n\n
\u201cWe are slower, but we are up and running,\u201d Diorio said.<\/p>\n\n\n\n
The county of more than 1 million residents includes Charlotte, but the city government appears not to have been hacked. The state\u2019s largest city issued a statement that its separate computer systems have not been affected and that it severed direct connections to county computers.<\/p>\n\n\n\n
The computer problems haven\u2019t affected the processing of emergency calls because they are handled by the city, said Mecklenburg County Sheriff\u2019s Office spokeswoman Anjanette Flowers Grube.<\/p>\n\n\n\n
But it\u2019s caused delays for the county jail and disrupted other county services ranging from domestic violence counseling to tax collection. Sheriff Irwin Carmichael said it\u2019s taking longer to manually process arrestees, as well as inmates due to be released.<\/p>\n\n\n\n
Calls to a county domestic violence hotline are rolling straight to voicemail, so counselors are checking messages every 15 minutes, officials told reporters. And the social services department is working to recreate its daily itinerary of 1,600 rides for elderly patients with medical appointments. Recurring appointments that account for most of the rides are less of a problem than those for patients who make one-time reservations.<\/p>\n\n\n\n
Patty Eagan, director of Mecklenburg County Social Services, said there are \u201c300 trips that are medical demand, and that\u2019s when someone has scheduled a trip a week ago, two weeks ago. We are not able to see what trips have been scheduled.\u201d<\/p>\n\n\n\n
Meanwhile, payments to the tax office must be made with a check, cash or money order, and code inspectors are slowed down by using paper records, according to a list of affected services.<\/p>\n\n\n\n
The hacking was publicly revealed Tuesday. A forensic examination has confirmed that 48 of the county\u2019s 500 servers were affected, Diorio said, adding that county government officials believe that the hackers weren\u2019t able to gain access to individuals\u2019 health, credit card or social security information.<\/p>\n\n\n\n
The compromised servers have been quarantined, and even potentially healthy parts of the system are currently shut down to avoid spreading the malicious program, said Keith Gregg, the county\u2019s chief information officer. But without getting the compromised servers unlocked, the county would have to rebuild significant parts of the system.<\/p>\n\n\n\n
A Wednesday afternoon deadline for paying the ransom passed, but Diorio said talks are continuing. The hackers have asked for the ransom to be paid in bitcoin, a digital currency used around the world and favored by hackers because it can often be exchanged online anonymously.<\/p>\n\n\n\n
A security expert said cyberattacks on local governments aren\u2019t unusual. For example, a hacking attack in late 2016 on San Francisco\u2019s mass transit system led its operators to allow free rides over part of a weekend because of data problems.<\/p>\n\n\n\n
Ross Rustici, senior director of intelligence services at the firm Cybereason, said ransomware schemes against local governments make the news every couple of months, but that they often tend to be smaller, rural areas. He said local governments are \u201ceasy targets\u201d because of their older equipment and software.<\/p>\n\n\n\n
He said businesses and local governments often pay the ransom because other means of recovering the data can be even more expensive.<\/p>\n\n\n\n
\u201cOnce you\u2019re in that situation, you really have no good option, so a lot of people and companies end up paying,\u201d he said.<\/p>\n\n\n\n
Data was frozen on dozens of Mecklenburg County servers after one of its employees opened an email attachment carrying malicious software earlier this week. The hacker responsible \u2014 believed to be in Ukraine or Iran \u2014 has demanded more than $23,000 to restore access.<\/p>\n","protected":false},"author":7,"featured_media":45846,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":10,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[10],"tags":[],"coauthors":[841],"class_list":["post-14703","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber"],"acf":{"subheadline":"","legacy_arc_id":"CF2TFXNGOBB7RKGAE2BO52WXY4","arc_canonical_url":"\/civilian\/2017\/12\/06\/deadline-looms-for-north-carolina-county-hit-with-ransomware\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n