Cyber Incident Victim: NYC Legal Services
Date:
Jun 2021
Location:
United States of America
Summary
A cyberattack targeted New York City's law department, prompting officials to disconnect its systems from the city network to contain the threat. Initial investigations revealed no evidence of compromised data or ransom demands, with authorities confirming the incident was not a ransomware case. The city's cybersecurity team detected anomalous activity through monitoring systems, triggering an ongoing forensic investigation while access to the department's network remained restricted. Officials expressed confidence in restoring secure operations promptly to resume legal services, acknowledging the persistent threat of such attacks against public institutions.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On June 8, 2021, New York City officials disclosed a cyberattack targeting the city’s Law Department, an agency employing approximately 1,000 lawyers. The attack prompted immediate containment measures, with city personnel disconnecting the Law Department’s computer systems from the broader municipal network on Sunday, June 6, following the discovery of suspicious activity. Mayor Bill de Blasio confirmed at a June 8 press briefing that no evidence of compromised data or ransom demands had been identified as of that time, characterizing the investigation as ongoing and evolving. City spokesperson Laura Feyer stated access to the Law Department’s network remained restricted as a precautionary security measure while forensic work continued. New York City Chief Information Security Officer Geoff Brown emphasized the incident did not involve ransomware but declined to speculate on potential attacker motivations, asserting confidence in restoring the department’s IT environment securely to resume normal operations promptly.
The New York Police Department’s Deputy Commissioner for Intelligence and Counterterrorism, James Brown, noted the city’s detection systems successfully identified anomalous activity, triggering involvement from NYC Cyber Command and external contractors. Investigators remained in the early stages of forensic analysis as of June 8, with no public attribution or technical specifics regarding the attack vector. Operational disruptions forced the Law Department offline indefinitely, impairing its capacity to conduct routine legal services for city residents. Mayor de Blasio contextualized the incident as part of an escalating trend of cyber threats against public and private entities, referencing the May 2021 Colonial Pipeline ransomware attack as a recent example. City officials provided no estimated restoration timeline but reiterated their priority was securing systems before reactivating network access.