City of Pascagoula

Summary

A ransomware attack targeted a Mississippi city through a third-party contractor, disrupting municipal operations by compromising computer systems and disabling certain phone lines. The incident was promptly contained by the city's IT contractor, preventing data loss in critical systems and avoiding any ransom payment. While email services and critical data were temporarily inaccessible, police operations were notably impacted, requiring manual record-keeping until systems were restored; however, no personal information was compromised, and backups ensured eventual data recovery. Most city functions resumed normal operations shortly after the attack.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On November 28, 2019, the City of Pascagoula, Mississippi, experienced a ransomware attack that disrupted municipal operations. The attack originated from a malware payload delivered through a third-party contractor connected to the city’s infrastructure. Acting City Manager Frank Corder confirmed the city’s IT contractor immediately quarantined and contained the incident upon detection, preventing widespread damage to critical systems. Hackers compromised portions of the city’s computer network, temporarily shutting down access to certain data and disabling some phone lines. While the attackers demanded a ransom payment, city officials explicitly stated no funds were paid. Critical systems avoided data loss, though some required reconfiguration, leading to lingering operational disruptions during recovery efforts. Email services and essential data repositories were temporarily inaccessible but not permanently lost.

The attack notably impacted the Pascagoula Police Department’s computer systems, forcing officers to manually complete paperwork using pen and paper until restoration. Police Chief Matt Chapman emphasized that departmental data remained secure through backups and would be fully recoverable once systems were restored. Municipal services experienced partial interruptions for several days, with some phones and non-critical systems remaining offline during the remediation phase. By December 10, 2019, the city reported near-full operational functionality. Officials reiterated that no resident or employee personal information was compromised during the incident. Security and technology experts continued working to resolve residual technical issues while maintaining system integrity through the recovery process.

Sources

Sources available to members: 1 source.