CSIDB logo
Incident

Philadelphia's online court system

Incident posture

Attack window
May 2019
Location
United States of America
Status
Historical
CIA posture
Available to members
Updated
2025-11-04 00:00

Linked entities

Victim
Philadelphia's online court system
Threat actors
0 actors
Sources
1 source

Timeline

Occurred
May 2019
Discovered
Pending
Disclosed
Pending
Resolved
Pending

Summary

A malware infection disrupted Philadelphia's online court system, prompting a precautionary shutdown of network access and electronic services. The incident blocked electronic document filings, jury duty signups, and temporarily disabled the court website and email systems, forcing reliance on paper processes and in-person operations. Housing law faced severe consequences as foreclosure postponement filings risked being lost in the manual workflow, potentially leading to wrongful home losses despite ongoing court proceedings. Legal aid organizations manually verified orders to mitigate errors, while the courts contracted cybersecurity experts for remediation without providing a recovery timeline. The disruption created operational chaos, extended wait times, and raised due process concerns as critical services remained offline indefinitely.

Motives

Detailed motive labels are available to members.

4 motives

TTPs

Detailed technique labels are available to members.

1 technique

Description

On May 21, 2019, Philadelphia’s online court system abruptly became inaccessible due to a malware infection, halting all electronic operations. The courts confirmed malware was detected on "a limited number" of computers, prompting a precautionary shutdown of network access to contain the threat. Officials provided minimal public details, citing concerns that disclosure might interfere with remediation efforts, though they confirmed engaging a cybersecurity firm to investigate. The immediate effect paralyzed electronic document filing, forcing attorneys and litigants to submit paperwork in person. This shift caused logistical strain, including longer wait times, physical file storage challenges, and reduced hours for accepting documents. Secondary disruptions included the court website’s inaccessibility, jury duty registration failures, and temporary email system outages, with jury duty excusals temporarily managed via Twitter. The courts remained physically open but operated under significant constraints, emphasizing manual processes while declining to specify a restoration timeline.

The outage disproportionately impacted housing law, particularly foreclosure proceedings. Defendants facing home repossession typically file postponement requests electronically to delay sales while preparing defenses, but the shutdown created risks of missed filings or lost paperwork. Community Legal Services attorney Rachel Gallegos petitioned for a month-long foreclosure moratorium, arguing the outage undermined due process, but the court denied the request, allowing foreclosures to proceed. Gallegos documented instances where postponement orders failed to reach sheriff’s offices, potentially due to internal system disruptions, requiring manual verification of "inch-thick" stacks of orders to prevent errors. Self-represented litigants faced heightened risks, as the electronic system’s absence could mislead them into believing courts were entirely nonfunctional. The court maintained limited public updates via Twitter, rescheduling jury duty and addressing complaints, while attorneys like Gallegos implemented ad hoc safeguards against procedural failures. No restoration timeline was published, with officials stating only that updates would follow as remediation progressed.

Sources

Sources available to members: 1 source.

CSIDB