Pierluigi Paganini May 07, 2023

The San Bernardino County Sheriff’s Department confirmed that it has paid a $1.1-million ransom after the April ransomware attack.

The San Bernardino County Sheriff’s Department opted to pay a $1.1-million ransom after a ransomware attack infected its systems in early April.

The ransomware attack forced the Police department to temporarily shut down some of its systems to prevent the threat from spreading. Impacted systems include email, in-car computers and some law enforcement databases.

The attack took place on April 7, the law enforcement immediately launched an investigation into the incident to determine the extent of the attack. Sheriff’s Department spokeswoman Gloria Huerta said that the investigation is still ongoing.

The Los Angeles Times reported that San Bernardino County paid half the total of the ransom ($511,852), while the remaining part was covered by the insurance carrier. The ransom was paid to “restore the system’s full functionality and secure any data involved in the breach.”

Despite the FBI and law enforcement bodies always recommend not paying ransom in these attacks, in this case, the department opted to pay likely because they had no other way to recover the encrypted systems or to avoid the disclosure of sensitive data.

“If you’re paying through cryptocurrency, you don’t know who you’re paying it to,” Clifford Neuman, the director of USC’s Center for Computer Systems Security, told the Los Angeles Times. “It could be a sanctioned entity, whether it’s Iran, whether it’s North Korea, whether it’s a terrorist organization.”

The ransomware gang that targeted the San Bernardino County Sheriff’s Department is suspected to be from Eastern Europe and has already targeted U.S. entities in the past.

Cities, hospitals, and school districts are privileged targets of cybercriminals because they have poor defense and their systems contain a lot of sensitive data.

We are in the final!

Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini

Please nominate Security Affairs as your favorite blog.

Nominate Pierluigi Paganini and Security Affairs here here: https://docs.google.com/forms/d/e/1FAIpQLSepvnj8b7QzMdLh7vWEDQDqohjBUsHyn3x3xRdYGCetwVy2DA/viewform

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, DLL ransomware)