Cyber Incident Victim: Hampton Roads Sanitation District
Date:
Nov 2020
Location:
United States of America
Summary
A ransomware attack targeted the Hampton Roads Sanitation District, compelling the organization to take its entire computer network offline to mitigate the threat. This action resulted in the suspension of the billing system, disrupting service for all customers dependent on the utility's operations and payment processing capabilities.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On November 17, 2020, the Hampton Roads Sanitation District (HRSD) experienced a ransomware attack that compromised its computer network. The attack forced HRSD to take its entire network offline as a containment measure, resulting in the immediate suspension of its billing system. Leila Rice, HRSD’s spokeswoman, publicly confirmed the incident and its operational impacts. The disruption affected all HRSD customers, as the billing system outage prevented normal transaction processing and customer service operations. No details were disclosed regarding the specific ransomware variant used, the initial attack vector, or whether data exfiltration occurred prior to encryption. The network-wide shutdown indicated the severity of the compromise and the organization’s prioritization of containment over partial service continuity.
HRSD’s decision to isolate its network represented its primary documented response action to halt further ransomware spread. The billing system suspension remained in effect indefinitely as of the initial disclosure, with no restoration timeline provided. Rice’s statements confirmed the attack’s operational consequences but did not specify whether emergency workarounds were implemented for critical wastewater management systems. The incident attracted public attention through media coverage by Pilot Online, highlighting the disruption to customer-facing services. No ransomware group claimed public responsibility, and HRSD did not disclose whether ransom demands were received or negotiated. The attack underscored the vulnerability of public utility infrastructure to disruptive cyber incidents affecting essential services.