Cyber Incident Victim: Ayuntamiento de San Bartolomé de Tirajana
Date:
Mar 2022
Location:
Spain
Summary
A ransomware attack targeted the Ayuntamiento de San Bartolomé de Tirajana, encrypting approximately 265,000 files (18% of total server data) and compromising multiple municipal servers. The intrusion was detected when employees could not access files, prompting IT technicians to isolate affected systems and halt further encryption by disabling compromised servers. While the attack's origin was traced to an IP address in Bosnia-Herzegovina, the initial entry point remained unidentified. Uninfected servers were cleaned, updated, and restored for critical operations, while infected systems remained offline. The municipality collaborated with National Police cybercrime units and a cybersecurity firm to investigate the breach, eradicate the ransomware, and monitor systems for residual threats.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On the early morning of March 11, 2022, the Ayuntamiento de San Bartolomé de Tirajana experienced a ransomware attack targeting its municipal servers. Municipal employees discovered the incident at approximately 7:30 AM when they could not access certain files, prompting immediate notification to the New Technologies department technicians. Initial analysis confirmed multiple servers had been compromised and infected, leading technicians to power down all servers showing security compromise indicators to contain the ongoing attack. Despite rapid intervention to identify the attack source, investigators could not pinpoint its exact origin but determined the ransomware's operational methods and traced a suspicious IP address allegedly originating from Bosnia-Herzegovina. Authorities blocked this IP address, effectively halting further ransomware execution. Forensic examination later revealed threat actors had encrypted 265,000 files, representing approximately 18% of the municipality's total server-stored data.
The attack caused sustained operational disruptions, with infected servers remaining offline while unaffected systems underwent cleaning, updating, and restoration for essential departmental functions. Municipal IT teams maintained continuous server monitoring while collaborating with Spain's National Police Cybercrime Unit in Las Palmas to investigate the intrusion. Concurrently, the Ayuntamiento engaged a cybersecurity firm to identify the attack's initial entry vector and ensure complete malware eradication from compromised infrastructure. No data exfiltration or additional attacker objectives beyond file encryption were disclosed in available reports. Recovery efforts focused on forensic analysis and infrastructure hardening, with no public confirmation regarding data recovery outcomes or ransom payment demands.