The ransomware attack on the server encrypted and renamed 90,000 files in roughly a minute and a half.
An email address that could be used to contact the hacker and discuss a ransom to unlock the data was discovered after online research on the extension appended to every impacted file.
No data was misplaced or stolen because the server was rebuilt from a backup.
"id": "CIT0112722",
"linkid": "city-of-mountain-home-id",
"type": "Ransomware",
"date": "03/2017",
"severity": "75",
"impact": "2",
"explanation": "Attack limited on finance or reputation"