BALTIMORE (WJZ) — The ransomware attack continues to plague Baltimore as the ransom deadline loomed Friday.
Mayor Jack Young said the city is working to resume services and cooperating with the FBI on their investigation.
Young told WJZ’s Mike Hellgren, the city is looking for some workarounds.
“We are looking at some workarounds to help the real estate industry,” Young said. “We have teams of lawyers and teams of experts who are familiar with this kind of thing that we’re facing in Baltimore and we’re hoping that we can have a fix for the real estate transactions but we have to make sure that it’s ok with the titling companies before we can move forward.”
It involves in-person visits to the Wolman building next to City Hall to process liens starting Monday from 7 a.m. to 7 p.m.
Right now, Baltimore’s email systems are still down, online payments remain down for water bills and traffic citations — but no late fees will be assessed. Although telephones work, voicemail does not. You can get permits in person or by phone. However, critical life and safety systems are operational.
Baltimore’s 311 system is still operational to answer citizen questions.
The ransom deadline was Friday and the hackers threatened to erase data, but Young said he hasn’t heard of anything being erased.
“I hope that they understand the harm they are doing to people — and seniors. For the people are trying to make transactions, our seniors are trying to downsize. Some of them are moving to other homes or nursing facilities and want to transfer properties,” Young added. “They need to think about the effect they are having on people in general. If they had any heart at all they shouldn’t be doing this kind of stuff.”
Mayor Young told Hellgren he is open to paying a ransom after days of saying the city would not do so.
“In order to move the city forward, I might have to think about it. I have not made a decision yet,” Mayor Young said.
The ransom started as 13 bitcoins or roughly $106,000 and has risen by $10,000 a day since the fourth day of the attack.
The FBI is assisting in the criminal investigation into the cyber attack.
Later in a statement, Young said he cannot talk about details of the attack.
“As everyone is aware, we discovered on May 7, 2019 that the City was the victim of a ransomware attack. We immediately went into incident response mode, quickly took services and systems offline to contain the attack, and activated key partners to help us investigate and respond. We established a web-based incident command, shifted operations into manual mode and established other workarounds to facilitate the continued delivery of services to the public. We continue to adjust and refine the delivery of those services that were only partly interrupted and to pursue ways to reactivate any services that were completely interrupted.
We are well into the restorative process, and as I’ve indicated, are cooperating with the FBI on their investigation. Due to that investigation, we are not able to share information about the attack. To the extent that we can, we will continue to keep you informed about our process.
As I’ve mentioned previously, we engaged leading industry cybersecurity experts who are on-site 24-7 working with us. As part of our containment strategy, we deployed enhanced monitoring tools throughout our network to gain additional visibility. As you can image, with approximately 7,000 users, this takes time.
Some of the restoration efforts also require that we rebuild certain systems to make sure that when we restore business functions, we are doing so in a secure manner.
I am not able to provide you with an exact timeline on when all systems will be restored. Like any large enterprise, we have thousands of systems and applications. Our focus is getting critical services back online, and doing so in a manner that ensures we keep security as one of our top priorities throughout this process. You may see partial services beginning to restore within a matter of weeks, while some of our more intricate systems may take months in the recovery process.
The mayor’s office, city agencies, and departments continue to work very closely with Baltimore City Information Technology (BCIT) to identify restoration priorities and assist with the recovery process.
Where possible, City agencies have enacted feasible alternatives and are continuing to do so.
Finally, my recently named Deputy Chief of Staff for Operations, Mrs. Sheryl Goldstein, begins her term on Monday, May 20. I’ve tasked her with advancing those performance management standards and analytics to effectively measure the impact of this incident and inform decisions going forward. Expect to receive regular updates from her about this incident and the City’s ongoing response.
Again, we appreciate the public’s patience as we work to restore normal operations.”