CivicSmart

Summary

A provider of smart parking meters and enforcement technology experienced a ransomware attack involving the Sodinokibi/REvil variant, resulting in unauthorized data access and theft. The attackers exfiltrated internal company files and publicly exposed them on a hacker-controlled website. The compromised systems supported mobile payment processing, parking regulation enforcement, and related applications used by municipalities and motorists globally.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

CivicSmart, a Milwaukee-based provider of smart parking meters and related enforcement technologies, experienced a ransomware attack in March 2020. The incident involved the Sodinokibi ransomware variant, also known as REvil, which compromised company systems and resulted in data theft. Attackers exfiltrated internal files from CivicSmart and publicly exposed them on a hacker-controlled website as part of the extortion attempt. The breach affected CivicSmart's suite of products, including payment-processing parking meters, parking enforcement hardware and software, and mobile applications utilized by both municipal employees and private motorists. The company's technology was deployed in cities worldwide, though specific impacted municipalities were not named in available reports. No details emerged regarding the initial attack vector, duration of system compromise, or quantity of stolen records. The public exposure of internal files suggested attackers obtained sensitive operational or technical information beyond standard customer data.

The incident exposed vulnerabilities in smart city infrastructure supporting municipal parking operations across multiple jurisdictions. Compromised systems handled payment processing and enforcement functions critical to urban mobility management, creating potential operational disruptions for client cities. Stolen data could have included technical specifications of parking systems, internal communications, or administrative credentials, though CivicSmart did not publicly confirm the exact nature of leaked materials. The ransomware group's publication of company files demonstrated successful data exfiltration preceding encryption, a double-extortion tactic increasingly common in 2020 cyberattacks. CivicSmart's global customer base faced secondary risks from potential exposure of integrated systems or municipal data processed through the company's platforms. No information was disclosed regarding ransom demands, payment status, or the company's incident response protocols beyond initial confirmation of the attack. The event highlighted security challenges facing IoT-enabled urban infrastructure providers whose systems bridge physical operations and digital payment ecosystems.

Sources

Sources available to members: 1 source.