Dallas information technology staff are still working with consultants and outside groups to help review and clean servers possibly impacted by ransomware with a focus on restoring systems from public safety departments first, then other public facing agencies, and then everything else. But it’s the restoration of some internal systems described as having background functions that will likely take the longest to complete.
“We are going to be working at this for weeks and months to do all the clean up,” Brian Gardner, the city’s chief information security officer, told The Dallas Morning News Thursday.
Gardner and Jack Ireland, the city’s chief financial officer, said no evidence has been found at this point that data stored by the city of personal information from employees and residents was leaked, nor is there any evidence found that internal data stored, such as police evidence or municipal court files, have been lost. They both said investigations and monitoring are still ongoing.
“We took some things down as precaution, probably more than we needed to, in order to isolate and make sure that it was clean before it was brought back into service,” Ireland said. “So it is taking some time to work through those different systems.”
Thursday marked day nine of the city dealing with the fallout of a ransomware attack from last Wednesday. Ransomware is a type of software often used to extort money from organizations by threatening to block access to files or release confidential information unless money is paid.
Ireland declined to say whether the city has issued any ransom, citing an ongoing criminal investigation by the Dallas police and FBI.
“There are things we’re just not able to share because it is an open investigation and a criminal act against the city,” said Ireland, who oversees the city’s information and technology services department.
City Manager T.C. Broadnax said Ireland “didn’t share specifics about any requests,” and that he wasn’t “recognizing that we’ve got any requests for ransom.”
“I don’t think we’ve identified or shared in any type of ransom request or actually even received one, to my understanding,” Broadnax said
The city on Thursday confirmed hacker group Royal was responsible for the cyber attack.
The attack disrupted several city departments, including causing the municipal courts to close; stopping residents from paying their water bills online; and forcing first responders to use radios, pens and paper to address and keep track of emergency calls.
Public computers and printers in at least some library branches are down. While the municipal court is open to give general information on citations, no hearings or trials are happening.
The court also couldn’t take any payments for citations or documents. The city says any payments due while the system is down will be accepted after service is restored.
The city has made some progress since last week. Websites for the city and police department are back online this week. Parts of the computer assisted dispatch system are also back with the city saying on Wednesday that police were gaining “computer functionality with less reliance on paper backups” each day.
The city also said Wednesday in a news release that computers in 22 Dallas fire vehicles, including trucks and ambulances, have been cleaned and are now able to accept automated dispatch information.
It resumed accepting applications for building permits on Sunday. Residents can resume paying water bills, but Dallas Water Utilities’ meter reading software may not return until sometime Thursday or later this week, according to the release.
©2023 The Dallas Morning News, Distributed by Tribune Content Agency, LLC.
