Hackers hit New Orleans city government website — are other cities at risk?

On Friday, December 13, the City of New Orleans was hit by a massive phishing and ransomware attack, shutting down government websites and leading to a state of emergency. At the time of writing, the sites are still down for the count, though city services are still available.

A city government that actually prepared for something? 

The city was prepared for a cyber attack, having trained employees on what to do in such an emergency and having made a great deal of business easy to do offline. As soon as an attack was suspected, all city servers were powered down, computers were shut off, and all city employees disconnected from government Wi-Fi.

Another attack hit Rapides Parish the same day. No data was taken, and it is unknown if the attack was related. Investigations into the attacks are ongoing. The FBI and Secret Service have been called in to assist local investigators.

While New Orleans is the most prominent American city to be targeted, this isn’t the first time that this kind of attack has hit a city. Cities in Texas, Georgia, and Florida have been hit alongside Johannesburg, South Africa, the largest city to be struck.

The threat of other attacks is taken seriously by many cities in the United States, and more than two hundred mayors around the country have agreed not to pay any demanded ransom as a means of discouraging potential attackers.

Why attack a city at all? 

Cities are often a little behind on technology, as anybody who has used a 10-year-out-of-date operating system while working for the government can attest to. Because of the importance of many of the systems cities operate, it can also be expected that some of them will pay the ransom to get their systems back online. When Johannesburg was hit, for example, government operations were severely affected.

This isn’t always given though, when New Bedford, Massachusetts, was hit by ransomware, they stalled the attackers until they replaced all of their needed software and machines. They didn’t pay a cent in ransom money. This doesn’t always work out though, Atlanta once paid $2.5M to get out of a $50,000 ransomware holdup

.

Is this the shape of things to come?

While the idea of launching a cyber attack on a major city to try and extort them for money might have been science fiction within living memory, it is now a common occurrence. The FBI, who hadn’t made a significant comment on cyber attacks since 2016, issued new guidelines this year on the changing nature of the attacks.

While cyber attacks are just as frequent as they’ve always been, general malware attacks such as WannaCry have given way to ransomware that is ever “more targeted, sophisticated, and costly.”They also warn that “ransomware actors have also targeted healthcare organizations, industrial companies, and the transportation sector.”

They are on to something, as is isn’t even the only notable cyber attack this week. The Epilepsy Foundation was just hit with an attack designed to trigger seizures in those with photosensitive epilepsy. In Canada, a major provider of heath diagnostic testing was also just hit.

It isn’t all doom and gloom, though, that FBI announcement also includes lots of better practices to protect yourself and your organization, such as setting anti-maleware solutions to update automatically and spreading awareness of such threats.

While New Orleans is going to come out of this hacking attempt little worse for the wear, the event shows us how an otherwise failed attack can disrupt even a well-prepared city. And remember, New Orleans has come out as well as it has so far because it was a particularly tricky city to hit. Imagine how it would look if a city with even more reliance on technology and no training were struck.