Florida City Pays Hundreds Of Thousands To Hackers

One small Florida city has had to pay cybercriminals thousands of dollars in ransomware.

Lake City, a community of about 12,000 people west of Jacksonville, forked over hundreds of thousands of dollars after a ransomware attack crippled its systems. The ransomware payment was approved during an emergency meeting on Monday (June 24), allowing the city to make a bitcoin payment worth about $462,000.

The week before, Riviera Beach, a Florida city of about 34,000, agreed to allow its insurance carrier to pay about $600,000 during its own cyberattack — nearly 12 times the size of the ransomware the city of Atlanta refused to pay last year.

These ransom demands are becoming more common, said Larry Ponemon of the Ponemon Institute. “There are a lot of copycats out there, and they figure they’re going to ride the gravy train,” he said, according to The Wall Street Journal.

Ransomware attackers are hitting companies and cities via vulnerabilities in their systems, often by sending malicious emails that allow them to freeze important data and then demand payments for decryption keys.

“We do see an increased frequency against municipalities,” said Michael Tanenbaum, head of North America cyber and professional liability at insurance giant Chubb.

While the FBI recommends not paying hackers because it encourages more attacks, some victims believe they have no choice but to give into the demands. In March, for example. Jackson County, GA paid $400,000 from its $10.5 million rainy-day fund after a cyberattack had compromised its backups.

“I thought we had a backup, but obviously we didn’t have a good enough backup for this kind of attack,” said Joe Helfenberger, city manager in Lake City. “Fortunately, we had all the financial data backed up properly off-site, so that wasn’t affected, but pretty much everything else was.”

“That might explain why the ransom is going up: The bad guys can get away with it,” said Ponemon.