City of Sarasota

The city of Sarasota was hit by a sophisticated malware attack that encrypted certain computer files and systems were encrypted.

City of Sarasota computer systems shut down after an employee opened an email containing the malware.

FBI immediately investigated the incident and recover most of the files and paid ransom to restore access.

Source: https://www.scmagazine.com/brief/city-of-sarasota-hit-with-ransomware/city-of-sarasota-hit-with-ransomware

TPRM report: https://www.rankiteo.com/company/city-of-sarasota

"id": "cit084622",
"linkid": "city-of-sarasota",
"type": "Malware",
"date": "6/2017",
"severity": "75",
"impact": "2",
"explanation": "Attack limited on finance or reputation"

{'affected_entities': [{'industry': 'Public Sector',
                        'location': 'Sarasota, Florida',
                        'name': 'City of Sarasota',
                        'type': 'Government'}],
 'attack_vector': 'Email',
 'data_breach': {'data_encryption': True},
 'description': 'The city of Sarasota was hit by a sophisticated malware '
                'attack that encrypted certain computer files and systems were '
                'encrypted. City of Sarasota computer systems shut down after '
                'an employee opened an email containing the malware. FBI '
                'immediately investigated the incident and recover most of the '
                'files and paid ransom to restore access.',
 'impact': {'operational_impact': 'System Shutdown',
            'systems_affected': ['City Computer Systems']},
 'initial_access_broker': {'entry_point': 'Email'},
 'investigation_status': 'Resolved',
 'motivation': 'Financial Gain',
 'post_incident_analysis': {'root_causes': 'Email containing malware'},
 'ransomware': {'data_encryption': True, 'ransom_paid': True},
 'response': {'law_enforcement_notified': True,
              'remediation_measures': ['File Recovery', 'Ransom Payment'],
              'third_party_assistance': ['FBI']},
 'title': 'Malware Attack on City of Sarasota',
 'type': 'Malware Attack'}