Files “were copied without permission” during the cyber attack, which was discovered on Feb. 9, and those files may have included names, Social Security numbers, driver’s license numbers, medical information and health insurance information, the agency said in a statement Friday.
Officials from the public defender’s office are still investigating whose personal data may have been stolen, and whether the personal data of attorneys or their clients was compromised, they said. A statement on the agency’s website urges “individuals” to remain vigilant against identity theft and fraud.
It’s been more than a month since public defenders across the state were locked out of their computers and files in the ransomware attack and hundreds of court hearings were delayed over the next week because public defenders couldn’t do their jobs.
Officials this week refused to answer questions from The Denver Post about what particular parts of the agency’s systems remain inoperable. In a ransomware attack, hackers use malware to hold an organization’s data hostage then demand a payment in cryptocurrency in order for organizations to regain access to that data.
The public defender’s office also would not disclose the amount of ransom demanded or whether a ransom was paid. A statement on the agency’s website says the office has “made progress in returning to full operations.”
Heavily redacted emails and text messages released to The Post by the Governor’s Office of Information Technology this week in response to an open records request mention the cyber attack recovery law firm Mullen Coughlin. Chief Deputy Public Defender Zak Brown would not confirm whether the public defender’s office is working with the firm.
“We have provided all the information we are able to at this time,” he said in an email.
A message left with the Pennsylvania-based law firm was not returned Wednesday.
The Governor’s Office of Information Technology redacted more than half of the text messages exchanged between members of its office and Colorado Public Defender Megan Ring between Feb. 9 and 23 on the grounds the messages were exempt from the state’s open records law. The office cited exemptions around attorney-client privilege, deliberative process, security arrangements and law enforcement investigations.
“OIT withholds these documents on the grounds that their release would result in substantial injury to the public because it would limit OIT’s ability to engage in honest and frank discussion of cybersecurity issues and provide uninhibited opinions to state agencies, thereby impeding OIT in the performance of its duties,” Chief Information Security Officer Jill Fraser wrote in an affidavit provided with the open records materials.
©2024 MediaNews Group, Inc, Distributed by Tribune Content Agency, LLC.
