City of Tomball

Summary

The City of Tomball experienced a criminal ransomware attack that potentially compromised personally identifiable information across multiple groups, including current and former employees, municipal court users, utility customers, and vendors. Exposed data elements included names, addresses, birthdates, Social Security numbers, and driver’s license or state ID numbers. Following the attack, immediate measures were taken to secure systems with third-party assistance, including forensic investigation to determine impacted files. Cybersecurity enhancements such as endpoint detection software deployment, password resets, and server rebuilds were implemented post-incident. While no evidence of information misuse was found, potentially affected individuals were notified to enable protective actions.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On or around December 20, 2022, the City of Tomball, Texas, experienced a criminal ransomware attack that compromised its systems. The City engaged third-party experts immediately to secure affected infrastructure and initiate an investigation into the incident’s scope. The investigation confirmed unauthorized access to files containing personally identifiable information (PII), though evidence of actual misuse remained absent. The City identified the impacted data categories on May 16, 2023, after a prolonged forensic review required to isolate compromised files. Affected individuals included current and former employees, users of the Municipal Court, utility customers, and City vendors or contractors. Exposed data elements varied by group but encompassed names, addresses, birthdates, Social Security numbers, and driver’s license or state ID numbers. The attack disrupted municipal operations, necessitating system-wide security overhauls to contain the breach and prevent further unauthorized access.

In response, the City implemented multiple cybersecurity enhancements, including deploying additional endpoint detection and response tools, resetting all user passwords, and rebuilding compromised servers. Notification letters were issued to inform potentially affected individuals of the breach, advising vigilance but confirming no detected misuse of their data. The City’s remediation efforts focused on isolating breached systems, analyzing attack vectors, and fortifying defenses against future incidents. Operational disruptions occurred during containment and recovery phases, though specific downtime durations or financial impacts were not disclosed. The forensic investigation prioritized identifying files with PII to determine notification obligations, a process delayed by the complexity of data categorization. No ransomware group or specific attack methodology was named in the City’s public disclosure. The incident underscored vulnerabilities in municipal IT infrastructure, prompting systemic upgrades to data protection protocols and access controls.

Sources

Sources available to members: 1 source.