San Bernardino County Pays $1.1m Ransomware

Hackers not only successfully infiltrated the computer network of the San Bernardino County's Sheriff Department, but also successfully extorted the county for $1.1 million dollars. The county carries insurance for such attacks, and the insurance share of the ransom came out to just over $511,000.

The county initially became aware of an infiltration on April 7, and began shutting down segments of its network while developing workarounds to access the data. Email systems were taken offline, and patrol units were forced to radio dispatch for background checks, rather than being able to use the computers in their own vehicles.

A month has passed since the intrusion was first detected, and investigations are still ongoing. However, the disruption to the network is deemed so severe that the county has agreed to pay the ransom. "The decision whether to render payment was the subject of careful consideration," the county said.

While no company wants to give money to hackers, sometimes their data is just too valuable for them to risk losing. "The cost is pretty brutal, not just to financial - but in the case of law enforcement - it's the agency, the people they are serving," said Vivek Bhandari of cybersecurity company Tanium. "In the hospitals, sometimes it can impact patient care, and we've seen that."

In addition to the financial loss often associated with ransomware, another potential issue with ransomware payments is that the payments draw attention to the poor cybersecurity practices of the victims. Other hacker groups quickly get word of the payment, and often target the same organisation in a secondary attack. As such, organisations need to ensure that they guard against even a single incident from occurring.

In this instance, hackers were able to infiltrate the network because a county staff member clicked on a malicious link. "Phishing attacks are very common ways for attackers to get in. You get a user to open a file, because, hey, here's a picture of your kid, or a picture from the get-together last week. Something that will get someone to open an attachment or click on a link is a common technique," Bhandari said.