Knoxville Pulls IT Systems Offline Following Ransomware Attack

A ransomware attack this week forced the government of Knoxville, Tenn., to shut down its servers, Internet connections, and computers. City officials say no personal information was compromised in the incident.

The attack took place overnight on Thursday, June 11, and was first detected by member of the Knoxville Fire Department around 4:30 a.m., according to the Knoxville News Sentinel. Shortly after the discovery, chief operations officer David Brace sent an email alerting city employees to the attack.

"Please be advised that our network has been attacked with ransomware," Brace wrote. "Information Systems is currently following recommended protocols. This includes shutting down servers, our internet connections, and PCs. Please do not log in to the network or use computer applications at this time," CBS affiliate WVLT reported. 

The city's IT team worked to shut down Knoxville's computer network, identify problems, and minimize damage, a spokesperson told WVLT. Parts of the city's website were offline Thursday, but Brace said public safety organizations, including fire and police departments, weren't compromised. Forensic and risk experts are working to resolve the issue, which has been reported to the FBI and federal government security teams, he said. The city is working with the Tennessee Bureau of Investigation.

So far, officials confirm city servers were affected but believe the attack is isolated. No backup servers were hit, Brace said, and the city's work can be rerouted through those. They believe the attack took place because an employee opened a phishing email, though this has not yet been confirmed.

With this incident, Knoxville becomes the latest in the string of US municipalities to face ransomware. Attackers have previously targeted Baltimore, Atlanta, Palm Beach, Fla., and New Orleans.

Read more details here.

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really bad day" in cybersecurity. Click for more information and to register.