Archdiocese of St. Louis

Summary

The Archdiocese of St. Louis experienced a coordinated ransomware attack that disrupted its online services and forced the takedown of multiple websites. The organization detected the intrusion and promptly took affected systems offline to contain the incident, characterizing it as a sophisticated campaign targeting their digital infrastructure. Service disruptions persisted as recovery efforts continued following the cybersecurity event.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On November 16, 2020, the Archdiocese of St. Louis discovered it had fallen victim to a coordinated ransomware attack that disrupted access to its websites. The attack rendered multiple Archdiocesan websites inaccessible, impacting online operations and public communications. Officials publicly confirmed the incident through an official statement characterizing the event as a deliberate ransomware campaign targeting their digital infrastructure. While the specific ransomware variant and initial attack vector remained undisclosed, the Archdiocese acknowledged the disruptive nature of the incident upon detection. The timing of the attack’s initiation relative to its November 16 discovery date was not detailed in available statements.

The immediate operational consequence centered on sustained website outages affecting the Archdiocese’s primary online presence. No specific details regarding data compromise, encryption scope beyond the websites, or ransom demands were publicly confirmed by the Archdiocese in the immediate aftermath. The organization’s response included public acknowledgment of the incident and likely involved internal efforts to contain the attack and restore services, though technical remediation steps were not explicitly outlined. The incident drew external attention through media coverage and cybersecurity community alerts, highlighting the vulnerability of religious institutions to such disruptive cyber campaigns. Service restoration timelines and any long-term operational or financial impacts stemming from the ransomware attack were not disclosed in the immediate reporting period following the November 16 disclosure.

Sources

Sources available to members: 1 source.