Cyber Incident Victim: City of New Bedford
Date:
Jul 2019
Location:
United States of America
Summary
A ransomware attack targeted a Massachusetts city's IT network, deploying Ryuk malware that encrypted files on 158 workstations, representing 4% of its total systems. Attackers demanded $5.3 million in Bitcoin for decryption keys, but officials countered with $400,000—an offer rejected by the hackers. The infection occurred overnight, limiting spread as most systems were inactive, and critical infrastructure remained unaffected. IT staff contained the breach by disconnecting compromised devices upon discovery. With negotiations failing and backups available, the city opted for system restoration rather than payment. The incident caused manageable operational disruptions compared to other municipal ransomware cases, avoiding service paralysis and significant financial loss.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
The ransomware incident impacting the City of New Bedford, Massachusetts, began on the night between July 4 and July 5, 2019, when attackers breached the municipal IT network and deployed Ryuk ransomware. This malware encrypted files on 158 workstations, representing 4% of the city’s total PC inventory. The timing of the attack during overnight hours limited its spread, as most city systems were powered down, preventing broader network compromise. City IT personnel discovered the encryption activity upon returning to work on July 5 and immediately implemented containment measures by disconnecting affected devices from the network. Forensic analysis confirmed the ransomware strain as Ryuk, which security researchers identified as a prevalent threat in targeted attacks during that period.
Through intermediaries, the city established contact with the attackers via a provided email address, initiating negotiations while continuing system stabilization efforts. The threat actors demanded a payment of $5.3 million in Bitcoin in exchange for decryption keys, which would have constituted the largest publicly disclosed ransomware payment at the time. Facing budgetary constraints and citing precedent from other municipal ransomware cases, the city counteroffered $400,000 using available insurance funds. The attackers rejected this proposal without providing a revised demand. With critical systems unaffected and backups verified as intact, New Bedford officials opted to restore encrypted systems from backups rather than prolong negotiations. Mayor Jon Mitchell publicly disclosed these events on September 4, 2019, emphasizing that the containment strategy prevented operational disruption to essential city services. The incident occurred amid a broader surge in ransomware attacks against U.S. municipalities, including contemporaneous incidents in Texas, Louisiana, and Florida where several local governments paid ransoms ranging from $400,000 to $600,000.