Cyber Incident Victim: Fort Collins Loveland Water District
Date:
Feb 2019
Location:
United States of America
Summary
A Northern Colorado utility experienced a ransomware attack that locked employees out of technical and engineering data, including critical drawings stored on their systems. The attackers demanded an undisclosed ransom, which the organization refused to pay, opting instead to restore access independently within approximately three weeks; this incident marked the second ransomware attack affecting the utility within a two-year period.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On February 11, 2019, employees of the Fort Collins Loveland Water District and South Fort Collins Sanitation District discovered they were locked out of technical and engineering data, drawings, and computer systems upon arriving at work. The districts had been targeted by a ransomware attack, with hackers encrypting critical operational data and demanding payment to restore access. General Manager Chris Matkins confirmed this was the second ransomware incident affecting the utilities within a two-year period. The attackers explicitly held the data hostage, though Matkins declined to disclose the ransom amount or demanded payment method, stating such details had no bearing on their response strategy. The immediate operational impact centered on the loss of access to essential engineering documents and technical records required for daily functions. No information was provided regarding the initial intrusion vector, duration of system compromise prior to detection, or whether customer data or external systems were affected.
The organizations did not consider paying the ransom and instead pursued independent recovery efforts. Within approximately three weeks of the attack, technicians successfully restored access to the encrypted data without capitulating to the attackers' demands. Matkins did not elaborate on the specific technical methods used to regain access or whether backups facilitated the restoration. The incident caused operational disruption during the three-week recovery period, though the full scope of financial or service-delivery impacts was not quantified in available reports. The resolution demonstrated the districts' ability to neutralize the attack without external payment, though recurring vulnerabilities were evident given the prior incident within the same timeframe.