A Dallas agency has admitted to paying hackers $170,000 after being hit by a ransomware attack.
The Dallas Central Appraisal District (DCAD), which determines the value of all county real estate and personal property for tax purposes, announced that it had been hacked on November 8, 2022.
The agency was involved in a ransomware attack that disrupted all computer systems and took its website offline for over two months.
Dallas County Chief Appraiser Ken Nolan told reporters that the attack likely entered the organization after an employee was tricked by a phishing email.
DCAD was under attack by the notorious Royal Ransomware group. The group demanded nearly $1 million worth of cryptocurrency to protect the decryption keys and stolen data from being published online.
Part of ransomware message:
“We are Royal Ransomware. If you are reading this note, we have hijacked your system. We can help you guys. We just need the money.”
Nolan sought help from the FBI, and DCAD worked with third-party experts to help negotiate with the attackers.
Ultimately, $170,000 worth of Bitcoin was paid out by DCAD to the Royal Ransomware Group from a rarely used emergency reserve fund.
The decision whether to pay the ransom to the hackers is a contentious one, with strong views on both sides of the debate. , seems to have decided that there is no practical alternative.
The lengthy outage at DCAD has created headaches for realtors and homeowners who have relied on agency websites to gather information related to property owners. In its latest update on the violation, the DCAD stated that emails sent since the incident have not been received and cannot be received, and that many email addresses listed on the website’s contact page are still not working. warning that it is not being monitored or monitored.
As a result, agencies are asking realtors with pressing issues to contact them by phone rather than electronically.
As we reported late last year, the Royal Ransomware Group does not follow the ransomware-as-a-service model and rejects affiliates.
In early December 2022, the equivalent of DCAD in Austin’s Travis County was also attacked by the Royal ransomware group. However, the system was restored in about a week without paying the ransom to the hackers.
