conti attacks Lowell
Incident Date:
April 1, 2022
Overview
Title
conti attacks Lowell
Victim
Lowell
Attacker
Conti
Location
First Reported
April 1, 2022
Lowell, a Finance Sector Company, Suffers Ransomware Attack
Overview of the Incident
Lowell, a finance sector entity dedicated to aiding individuals in achieving debt freedom, has fallen victim to a ransomware attack orchestrated by the Conti group. This cyber assault has severely disrupted the company's operations, rendering servers, networks, telecommunication systems, and other critical infrastructures inoperative. Concurrently, the city of Lowell, Massachusetts, with a population exceeding 111,000, reported a "cyber-related incident" on April 24, 2023, which significantly impacted its network and various operational systems.
Impact on City Operations
The ransomware attack has precipitated considerable delays in city services. Although some telephone services have been reinstated, efforts to fully restore other systems are ongoing. The city has opted to maintain several systems offline as part of its recovery strategy. The Play ransomware group, known for its previous attacks on government entities in Latin America and Oakland, California, has taken responsibility for this incident. The group has disclosed an unspecified volume of sensitive data, encompassing personal information, passports, government IDs, financial records, budgets, and departmental documents.
In response to the attack, the city is collaborating with state and federal law enforcement agencies to conduct a thorough investigation. Despite the disruption, the city's website continues to offer information on its services, including tools for debt management and benefits calculation.
Trend of Ransomware Attacks on Local Governments
The incident in Lowell is indicative of a broader trend of ransomware attacks targeting local governments across the United States. Cities of varying sizes, including Dallas, Atlanta, and Baltimore, have faced similar cyber threats. These attacks underscore the critical need for robust cybersecurity defenses to prevent, mitigate, and recover from such incidents.
Current Status and Recovery Efforts
As of now, the city of Lowell has not disclosed specific details about the nature of the attack. However, it is known that the city's geographic information systems are currently inaccessible to external users, and certain city departments are required to conduct operations from City Hall. Fortunately, data stored on the city's network remains intact, though information saved on individual desktop computers was compromised during the recovery process.
The ransomware attack on Lowell serves as a stark reminder of the importance of implementing comprehensive cybersecurity measures. These include the deployment of secure software solutions, conducting regular training for staff, and maintaining up-to-date backup systems. Failure to establish such precautions may expose the city to potential claims from citizens affected by the breach.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.