St. George Fire District Sues Cybersecurity Firm Over Alleged Network Breach
Summary
The St. George Fire Protection District is suing General Informatics over a December 2023 breach. The lawsuit alleges compromised remote-access credentials and security weaknesses; the district says it had to rebuild its network.
Key points
- The fire district filed suit seeking damages over a December 2023 network breach, alleging its contracted cybersecurity firm failed to prevent it.
- The lawsuit says hackers used legitimate tools to remain inside the network and that attorneys suspect they may have intended to lock the district out and demand a ransom.
- According to the filing, law enforcement found compromised remote-access credentials and said the same hackers had also attacked an unnamed municipal agency.
- The lawsuit alleges General Informatics reused remote-access credentials across clients and continued using credentials after law enforcement warned they were compromised.
- A post-incident review reportedly found compromised domain controllers, administrative credentials stored in plain text, missing firewall logs, and inadequate network segmentation.
- The district says it had to rebuild its network, including replacing servers, switches, domain controllers, and firewalls; General Informatics sought to move the dispute to arbitration.
Article Details
- Victim Organization
- St. George Fire Protection District
- Incident Type
- Network breach involving hackers reportedly using legitimate tools to remain hidden; domain controllers were compromised.
- Data Types Exposed
- Administrative credentials (a plain-text note containing credentials was found; the article does not report that they were stolen)
- Operational Impact
- The fire district rebuilt its entire network, including replacing servers, switches, domain controllers, and firewalls, and establishing new backups.
- Ransom Or Extortion
- The district’s attorneys suspected the attackers intended to lock the district out of its network until a ransom was paid. The article does not report that a ransom demand was made or paid.
- Claim Status
- confirmed