cyber.hendryadrian.com
Cyber Attack & Data Breach · dysruptionhub.com

Lancaster, Ohio, Still Recovering After Ransomware Forced City Computers Offline

· Original article ↗

Summary

Lancaster, Ohio, took municipal computers offline after ransomware alerts appeared on employee machines. City records later confirmed the incident; about 90% of data and programs had been recovered, while the rest remained under review.

Key points

  • Ransomware alerts appeared on multiple employee machines on Aug. 6, prompting the city to take its personal computers offline while investigating and containing the threat.
  • The city remained operational; an alert said 911, water, wastewater and telephone systems were not directly affected.
  • Aug. 28 meeting minutes said about 90% of data and programs had been recovered, with work continuing on the remainder.
  • Some data or programs might not be restored because of security concerns; the city was working with its cyber insurance provider on additional safeguards.
  • Lancaster was considering additional endpoint detection and response software alongside its existing SentinelOne security software.
  • Officials have not said whether personal, financial, employee or resident information was accessed or copied, and have not disclosed the initial access method, ransom demand, payment, malware family or responsible actor.
  • The Aug. 28 minutes were the latest documented recovery update described in the article; the city had not posted a later update.

Article Details

Victim Organization
Lancaster, Ohio
Incident Type
Ransomware incident
Operational Impact
The city took municipal computers offline to investigate and contain the possible threat. The city remained operational, and 911, water, wastewater, and telephone systems were reported as not directly affected. About 90% of data and programs had been recovered by the Aug. 28 committee meeting; recovery of the remainder was ongoing, and some data or programs might not be restored for security reasons.
Ransom Or Extortion
No ransom demand or payment was reported. Officials did not disclose whether data was accessed or copied.
Claim Status
confirmed

People

Mark StarrLancaster information technology department representative who reported the recovery status at a committee meeting.

Products

SentinelOneAccording to the minutes, Lancaster already used SentinelOne security software and was considering other endpoint detection and response software as an additional layer of protection. Officials said the project team’s

Related Articles