‘The data will be leaked soon’: Threat about Dallas ransomware attack surfaces

Posted by pakurilecz@reddit | Dallas | View on Reddit | 41 comments

from the Dallas Morning News An online blog post by a [**group claiming responsibility for Dallas’ ransomware attack**](https://www.dallasnews.com/news/public-safety/2023/05/04/a-group-called-royal-is-behind-the-ransomware-attack-on-dallas-the-city-said/) says a leak of employees’ personal information and other data stored by the municipal government will happen soon. In the post Friday, Royal noted the city saying [**there was no evidence that data from residents, vendors or employees has** ](https://www.dallasnews.com/news/politics/2023/05/09/dallas-ransomware-attack-no-personal-data-leaks-it-says-working-to-restore-all-services/)[**been released**](https://www.dallasnews.com/news/politics/2023/05/09/dallas-ransomware-attack-no-personal-data-leaks-it-says-working-to-restore-all-services/) from Dallas servers after [**the May 3 attack**](https://www.dallasnews.com/news/2023/05/03/dallas-websites-affected-by-outages-possible-ransomware-attack/). The hacker group in the post replied that “the data will be leaked soon.” “We will share here in our blog tons of personal information of employees (phones, addresses, credit cards, SSNs, passports), detailed court cases, prisoners, medical information, clients’ information and thousands and thousands of governmental documents,” the post said. As of Friday morning, no city information has appeared on the website, which lists at least several dozen other organizations the group claims to have taken data from, such as the Lake Dallas Independent School District. Some of the posts about other organizations are accompanied by links to download files Royal claims to have stolen, but many others have no link. [https://www.dallasnews.com/news/politics/2023/05/19/dallas-ransomware-attack-leak-of-personal-info-threatened-in-blog-post/](https://www.dallasnews.com/news/politics/2023/05/19/dallas-ransomware-attack-leak-of-personal-info-threatened-in-blog-post/)

Reply to Post

41 Comments

[-]

jeffjones30@reddit

Believe the city would be liable for hippa violations based on the medical part getting out. Could be a billion dollar suit just for that.

[-]

Guiac@reddit

I've asked this question before and never gotten a clear answer. I don't think the city is technically a "covered entity" as per HIPPA rules and so would not be liable. It may be that it depends on exactly what information they have stored though.

[-]

patmorgan235@reddit

If the city runs any clinics that patient data is covered. IDK about data that's reported to them from other providers for public health purposes.

[-]

Guiac@reddit

Parkland is Dallas county - was their data breached?

[-]

pakurilecz@reddit (OP)

https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity/ransomware-fact-sheet/index.html

[-]

jeffjones30@reddit

I deal in electronic medical software, If simply encrypted then no breach no need to report. But since they copied it and will leak it a breach has occurred. Everyone has to be notified and they can sue.

[-]

pakurilecz@reddit (OP)

This information would have been helpful in your initial message

[-]

jeffjones30@reddit

Well depends on a lot of things and since I don’t work for the city I can only speculate. The software I sell uses an encrypted database. So no need to disclose. Some are in plain text or just save completed charts as a pdf. Also personal health records could be part of court information. Child welfare cases, or animal control. I doubt all of them have robust protection.

[-]

pakurilecz@reddit (OP)

what I meant is that you have more knowledge about HIPAA than the ordinary commenter and letting that be known in your first response would have been helpful. dont need ot know what you sell just that you are very knowledgeable

[-]

Odh_utexas@reddit

At this point it’s already a breach, regardless of what the ransomers do.

[-]

DefiniteKook@reddit

Why can’t we revamp how social security numbers work? We get new credit cards, passwords, locks on our houses. Why can’t we do the same for social security? Seems dumb that we are stuck with the same 9 digit code for the rest of our lives.

[-]

KingOfTheWolves4@reddit

The logistics would be a nightmare for multiple reasons. It basically all boils down to the government software being extremely outdated and the various documentation over the course of one’s life that would be different (tax returns, loans, etc).

[-]

Elguapo69@reddit

Visa has way more credit card numbers than the US has SSN. It’s not as big of a logistical nightmare if you use technology to help.

[-]

tennisgoalie@reddit

Visa didn’t build the entirety of their infrastructure around the assumption that a single person could never change their credit card number.

[-]

KingOfTheWolves4@reddit

Okay?? Credit cards =/= SSN. It’s a huge logistical nightmare partly due to the technology. The pure amount of training and implementation would take literal years, possibly decades. To be clear, I think it should change, but I don’t agree with the notion that just sprinkling in some technology would fix it.

[-]

Elguapo69@reddit

I’m not saying it’s easy, cheap, or would be fast. Maybe my post came off that way. But as a software engineer I know it’s doable. It’s important enough to launch the effort and you have to start somewhere. The government has a system already to change SSN. Which implies they could update all records associated with your old to your new. So that part is already solved. You’d just have to coordinate and do it at scale. The tricky part would be coordinating with all legitimate entities that use your SSN. mortgages, banks, etc But those are private companies and they’d never use your SSN as their primary key in their data. So if you got them an Xref of old to new they could update their systems. Also changing it once is not enough you need a way to allow changes at any time. So an event driven model where companies authorized could subscribe to SSN change events would be needed as well. So yeah it would be a project of epic scope but it’s very doable.

[-]

yourheartisaweapon@reddit

it would require more than these institutions are willing to do, so i don’t see it happening, even though i agree with your arguments. but it also isn’t unprecedented at the federal government level - they could model something like this off of the mass change of medicare beneficiary id #s a few years back. medicare ids used to be your ssn (plus a letter) and are now unique ids.

[-]

jcdang@reddit

The Dallas CIO in charge of IT worked for the SSA. Im sure he applied the best practices he learn from how the SSA runs.

[-]

DefiniteKook@reddit

Damn, so the guy who is technically responsible for thousands of city employees’ sensitive info getting hacked, also worked for another outdated bureaucracy? Who would’ve guessed.

[-]

jcdang@reddit

You're being modest with the number of people he has affected. https://dallascityhall.com/departments/ciservices/Pages/cio.aspx

[-]

Tadaaaaaaaaaaaaa@reddit

It's been tossed around that blockchain tech could be used to solve this problem. But as another person said, it would be an absolute nightmare to implement.

[-]

studyabroader@reddit

And the library system is still down and might be for WEEKS longer😭😭

[-]

Dreadkeeper@reddit

Kind of low priority when emergency services is down.

[-]

studyabroader@reddit

Agreed! Though to say it's down is a bit of a misnomer. 911 is still working. The system they usually use is not. DPD spokesperson Melinda Gutierrez confirmed to TechCrunch that the outage has also impacted Computer Aided Dispatch, or “CAD” systems, which are used by dispatchers and 911 operators to prioritize and record incident calls. Local media reported that this has forced 911 call takers to manually write down instructions for responding officers. “There is no effect to 911 calls at this time, and they continue to be dispatched for service,” Gutierrez added. “The outage is not affecting police response.”

[-]

No_Bend8@reddit

What is "the point" of this though? Honestly I'm missing it. Addresses? Who cares where these people live? What does this group 'royal' claim they want to *not* release city workers Social Security numbers?

[-]

DoublexxSushi@reddit

City employees includes police officers - which includes undercover officers.

[-]

No_Bend8@reddit

Oh. Interesting. I didn't consider that either. Ty

[-]

pakurilecz@reddit (OP)

They are after money and hope that the threat of releasing personal information will force the city to pay them. Ain't going to happen

[-]

DefiniteKook@reddit

Lol, they actually think the city who cheaped out on cyber security will pay ransom for their employees info? I think they have their cities confused lol.

[-]

pakurilecz@reddit (OP)

The City hasn't cheaped out on cybersecurity. This ransomware attack was the result of a phishing attack. someone clicked on a link in an email, just like what happened with DCAD. Vast majority of ransomware attackes are the result of phishing As soon as the City's ITS security knew what was taking place they started to isolate systems.. they are slowly bringing systems back up depending upon their criticality to City Operations.

[-]

JLOBRO@reddit

It’s doubtful the city “cheaped out” on cybersecurity. Much more likely they just got lucky and phished a login from the right (or wrong) person.

[-]

librarymania@reddit

They have a lot more than address and SSNs. Their initial target was Dallas PD, then the courts, spreading to other departments from there. They’ve done this to other cities, starting with police departments first. They have all of the police departments and courts data. Everything. Current investigations, trial evidence, a vast amount of information that is seriously critical. As far as what Royal wants, the city isn’t saying. But they want money. Depending on the target, in the past Royal has demanded between $250,000 to $60,000,000, paid in bitcoin. They use what’s called a double extortion strategy. First, they demand an amount of money to decrypt the data and the volume shadow copies. If this is paid, Royal provides a small sample amount of data as proof. (If everything is backed up to external cloud storage then it can probably still be recovered, so the city may not agree to pay.) However, regardless of whether the city pays the ransom to decrypt the data and the volume shadow copies, Royal then demands a ransom be paid to have the data returned and makes a promise to not release any of it. Or, in other words, they threaten to release the data if it is not paid.

[-]

No_Bend8@reddit

Thanks fot this response. This is the stuff I didn't know and I'm glad to be better informed. I've never heard of this happening in other cities. Guess I should pay better attention to the news

[-]

librarymania@reddit

If I remember right, this is the biggest city they’ve attacked. I didn’t know any of this stuff until very recently. I work for the libraries, and I’ve had some time to look into all this since the servers for our catalog were taken down due to this whole mess.

[-]

Baked_Schwan@reddit

Does anyone have a link to the blog post in question? I am curious to see their direct words to the city

[-]

librarymania@reddit

I find it weird that they’re calling it a blog post. It’s not really a blog. It’s a .onion site only accessible via Tor, - the same link that the city was given where they can negotiate the ransom. The page was just updated to include this announcement from Royal. It’s literally just a chat box to talk to them to negotiate payment, and below that is the threat to release the information. There have been a few websites that posted the initial ransom letter that printed off all the city’s printers on the day of the attack - some of those sites didn’t redact the url. That’s where you can see it. But I don’t recommend going to the site. And if anyone thinks it’s a good idea to do anything extra foolish like trying to negotiate with Royal on there, just know the FBI is monitoring.

[-]

Baked_Schwan@reddit

Ah gotcha, should've figured it would be a .onion. thanks!

[-]

Versatile_Investor@reddit

Just started with the city and got this message. Fantastic. Any idea of where the hackers are from?

[-]

pakurilecz@reddit (OP)

here are some urls with information about Royal [https://unit42.paloaltonetworks.com/royal-ransomware/](https://unit42.paloaltonetworks.com/royal-ransomware/) [https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-royal](https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-royal)

[-]

Versatile_Investor@reddit

Thanks! Are these guys ever caught? From the articles it sounds like they form new groups all the time.

[-]

BitGladius@reddit

I didn't check the article to see where they're from, but apparently in places like Russia it's just a case of don't shit where you eat. As long as the targets are foreign it's tolerated.