City of Torrance

The DoppelPaymer Ransomware group targeted the City of Torrance in the Los Angeles metropolitan area, California, stole its unencrypted data, and encrypted the devices.

The attacker encrypted approximately 150 servers and 500 workstations and stole about 200+ GB of files containing 269,123 files throughout 8,067 directories.

They also leaked numerous leaked file archives stolen from the City with a page titled "City of Torrance, CA" on their site called "Dopple Leaks".

The attackers demanded a 100 bitcoin worth $689,147 ransom for a decryptor and to take down files that were publicly leaked, and not to release more stolen files.

Source: https://www.bleepingcomputer.com/news/security/doppelpaymer-ransomware-hits-los-angeles-county-city-leaks-files/

TPRM report: https://www.rankiteo.com/company/city-of-torrance

"id": "cit20214622",
"linkid": "city-of-torrance",
"type": "Ransomware",
"date": "6/2017",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of a geographical region"

{'affected_entities': [{'industry': 'Public Administration',
                        'location': 'Los Angeles metropolitan area, California',
                        'name': 'City of Torrance',
                        'type': 'Government'}],
 'data_breach': {'data_exfiltration': 'Yes'},
 'description': 'The DoppelPaymer Ransomware group targeted the City of '
                'Torrance in the Los Angeles metropolitan area, California, '
                'stole its unencrypted data, and encrypted the devices. The '
                'attacker encrypted approximately 150 servers and 500 '
                'workstations and stole about 200+ GB of files containing '
                '269,123 files throughout 8,067 directories. They also leaked '
                'numerous leaked file archives stolen from the City with a '
                "page titled 'City of Torrance, CA' on their site called "
                "'Dopple Leaks'. The attackers demanded a 100 bitcoin worth "
                '$689,147 ransom for a decryptor and to take down files that '
                'were publicly leaked, and not to release more stolen files.',
 'impact': {'data_compromised': ['200+ GB of files',
                                 '269,123 files',
                                 '8,067 directories'],
            'systems_affected': ['150 servers', '500 workstations']},
 'motivation': 'Financial',
 'ransomware': {'data_encryption': 'Yes',
                'data_exfiltration': 'Yes',
                'ransom_demanded': '100 bitcoin worth $689,147',
                'ransomware_strain': 'DoppelPaymer'},
 'threat_actor': 'DoppelPaymer Ransomware group',
 'title': 'DoppelPaymer Ransomware Attack on City of Torrance',
 'type': 'Ransomware'}