Chenango County: Chenango County, N.Y., Computers Hit with Ransomware Attack

Cyberattack Disrupts Chenango County Government Systems Ahead of Election

Chenango County, New York, experienced a ransomware attack on October 18, locking roughly half of its 400 government computers. The incident, investigated by the New York State Department of Homeland Security, is believed to have originated from attackers based in Hong Kong. The perpetrators demanded $450 per machine totaling approximately $90,000 for their release, though county officials confirmed they would not pay the ransom.

The attack primarily targeted the county’s email system, likely compromised through a remote login vulnerability exacerbated by increased remote work during the pandemic. IT Director Herman Ericksen, with nearly 35 years in the department, called it the first cyberattack of its kind he had encountered. While most departments were affected, the sheriff’s office, social services, and the Department of Motor Vehicles remained operational due to independent networks.

With the presidential election less than three weeks away and early voting set to begin, the Board of Elections was prioritized for recovery. Though ballot counters, poll pads, and printers remained functional, the department could not process reports beyond tracking received ballots. Elections Commissioner Carol Franklin noted the strain of handling over 5,000 absentee ballots more than double the typical volume without full system access.

County employees have resorted to paper records and manual workarounds while systems are restored from backups. The New York State Board of Elections is assisting with ballot verification, and Franklin assured voters that election integrity would not be compromised, though delays in reporting were expected. Ballots are being secured under lock and key to prevent tampering.

Source: https://www.govtech.com/security/Chenango-County-NY-Computers-Hit-with-Ransomware-Attack.html

Chenango County Personnel Department cybersecurity rating report: https://www.rankiteo.com/company/chenango-county-personnel-department

"id": "CHE1780100849",
"linkid": "chenango-county-personnel-department",
"type": "Ransomware",
"date": "10/2020",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"

{'affected_entities': [{'customers_affected': 'Government employees and voters '
                                              '(Board of Elections)',
                        'industry': 'Public Sector',
                        'location': 'Chenango County, New York, USA',
                        'name': 'Chenango County Government',
                        'size': '400 computers',
                        'type': 'Government'}],
 'attack_vector': 'Remote login vulnerability',
 'customer_advisories': 'Voters assured of election integrity despite delays '
                        'in reporting',
 'data_breach': {'data_encryption': 'Ransomware encrypted data on affected '
                                    'systems'},
 'date_detected': '2020-10-18',
 'description': 'Chenango County, New York, experienced a ransomware attack on '
                'October 18, locking roughly half of its 400 government '
                'computers. The incident disrupted government operations, '
                'including the Board of Elections, ahead of the presidential '
                'election.',
 'impact': {'operational_impact': 'Disrupted email system and government '
                                  'operations; manual workarounds required',
            'systems_affected': 'Roughly 200 of 400 government computers'},
 'initial_access_broker': {'entry_point': 'Remote login vulnerability'},
 'investigation_status': 'Ongoing (investigated by New York State Department '
                         'of Homeland Security)',
 'post_incident_analysis': {'corrective_actions': 'Restoring systems from '
                                                  'backups; implementing '
                                                  'manual workarounds',
                            'root_causes': 'Remote login vulnerability '
                                           'exacerbated by remote work during '
                                           'the pandemic'},
 'ransomware': {'data_encryption': 'Yes',
                'ransom_demanded': '$90,000 ($450 per machine)',
                'ransom_paid': 'No'},
 'references': [{'source': 'Cyber Incident Description'}],
 'response': {'containment_measures': 'Systems restored from backups; manual '
                                      'workarounds implemented',
              'network_segmentation': 'Independent networks for sheriff’s '
                                      'office, social services, and DMV',
              'recovery_measures': 'Prioritized recovery for Board of '
                                   'Elections; securing ballots under lock and '
                                   'key',
              'remediation_measures': 'Restoring systems from backups',
              'third_party_assistance': 'New York State Department of Homeland '
                                        'Security, New York State Board of '
                                        'Elections'},
 'threat_actor': 'Attackers based in Hong Kong',
 'title': 'Ransomware Attack on Chenango County Government Systems',
 'type': 'Ransomware',
 'vulnerability_exploited': 'Remote login vulnerability exacerbated by '
                            'increased remote work during the pandemic'}