City of St. Helena

Summary

In a repeat incident occurring shortly after earlier network disruptions, the California municipality suffered a cyberattack that forced officials to shut down computer systems and the public library as a precaution. The city's antivirus software blocked numerous intrusion attempts starting in the early morning, with further irregularities detected several hours later, potentially compromising more than 20 computers and a network server. Law enforcement cybersecurity experts from the Northern California Computer Crimes Task Force, U.S. Secret Service, and FBI were engaged to conduct a forensic investigation, while officials confirmed that water, wastewater, and emergency services remained unaffected on separate networks.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On Monday, the City of St. Helena, California, experienced a cyberattack that prompted city officials to shut down municipal computer systems and the St. Helena Public Library as a precautionary measure. The city is located approximately 65 miles north of San Francisco in Napa Valley. According to an emailed statement from the city, the incident drew the involvement of the Northern California Computer Crimes Task Force, an organization that provides computer forensic assistance to law enforcement agencies. The Northern California Computer Crimes Task Force response included law enforcement cybersecurity experts from the United States Secret Service and the FBI, who were tasked with reviewing the system and completing a forensic investigation of the files. An initial review suggested that the cyberattack may have compromised more than twenty computers and a network server within the city's environment.

The attack sequence began in the early morning hours when the city's antivirus system blocked numerous attacks starting at 1:30 a.m. on Monday. Officials noted that the virus appeared similar to one that had previously struck other cities in California, including Oakley, which suffered a cyberattack in February. Around 7 a.m., city staff observed further irregularities in the computer network and contacted the city's IT contractor. By 9:30 a.m., administrators from the city's Emergency Operations Center convened, and the decision was made to close the St. Helena Public Library. The library had previously experienced disruptions the month before, when suspicious network activity led to downed phones, Wi-Fi, and some virtual services. The city did not confirm whether the two incidents were related.

The City of St. Helena operates more than twenty-five cloud systems, some of which house sensitive data for employees, businesses, and residents. Despite the cyberattack, officials confirmed that all city files had been backed up the previous day, Sunday, as part of the city's cybersecurity and business continuity plan. The city stated that although all files were backed up and appeared to be safe, it would most likely take between twenty-four and seventy-two hours before the cybersecurity experts could clear the systems and restore the backed-up files. The city also clarified that water and wastewater plants and emergency services were not affected by the incident because they operate on separate networks. The event marked the second cyberattack to strike the Northern California city within a span of less than a month, reflecting an ongoing pattern of malicious activity targeting municipal infrastructure in the region.

Sources

Sources available to members: 1 source.