Kevin Beaumont
A few days ago, IT systems and services at Leicester City Council stopped working. Councillors were not told the cause. (Link: https://www.leicestermercury.co.uk/news/leicester-news/systems-outage-leicester-city-council-9151322)
At 7pm this Friday, they tweeted it is a "cyber incident". Services are still offline.
Kevin Beaumont
I've checked and every network service at Leicester City Council's network border is offline, including Citrix Netscaler and Cisco AnyConnect VPN.
There's a high chance it's ransomware.
Shaun Dyer
@GossiTheDog My mate works there he said it’s a nightmare right now.
pitch R.
@GossiTheDog Nice. Is this a first in GB? In Germany we had "anhalt bitterfeld" beeing ransomwared. they "luckily" found a bunch of unexpenxted eternal offline data duplications with their contractors... So not having a data retention process actually payed of...
Kevin Beaumont
Confirmed it is a ransomware group.
My take would be the ransomware operator has made a mistake here as Leicester council have about 0% chance of being able to afford to pay - a year ago they described their existing budget as having a "near impossible cliff edge" to central government and they haven't received additional funding since - so the operator shoved the group's head into a beehive, the ransomware group should probably help them out.
Kevin Beaumont
Leicester City Council are still offline.
Kevin Beaumont
Leicester City Council say a UK government minister is pressuring them not to disclose what happened (it’s ransomware). https://therecord.media/leicester-uk-cyberattack-local-council
Kevin Beaumont
The UK government really needs a radical rethink on ransomware IMHO. If you can’t even say the word you can’t manage the problem.
Kevin Beaumont
Leicester City Council remains offline, from my automated monitoring, from their ransomware incident. A person in the council tells me they’ve been told not to admit it is ransomware by central government.
The BBC reports they expect to return mid week. My take - very unlikely they will get back online mid week.
Kevin Beaumont
You may be surprised to know Leicester City Council have not returned mid-week, and are presently in “maintenance”.
Kevin Beaumont
Leicester City Council ransomware incident rumbles on, having civil society impacts.
UK gov pretending it isn’t ransomware still.
Gledster
So the British Library is still in recovery mode, now they hit councils.
It's not a great prediction to say that more will be hit this year.
Austerity cut backs will have affected IT depts, and you do get what you pay for. :(
Kevin Beaumont
Leicester City Council say it will be at least another two weeks until they restore IT services after ransomware incident (sorry, cyber incident)
Kevin Beaumont
Leicester City Council are working towards service restoration (I have monitoring of their network border and most services are offline still).
They do not know if there was data exfiltration yet.
They are using law enforcement as a shield to not say the word ransomware.
https://news.leicester.gov.uk/news-articles/2024/march/cyber-incident-update-19-march-2024/
Kevin Beaumont
Two weeks in, Leicester City Council just got their residential services portal back online, so the recovery continues. https://my.leicester.gov.uk/
Fediverse Contractor
Loman-Feusagach
@GossiTheDog I don't understand how it takes so long to get back online. Do they not just burn down the instances and recover from backup? I assume I am missing a key point in how this happens.
Loman-Feusagach
@GossiTheDog hmmm, so no offline drives in rotation. Seems like a new (old) idea about backups need to become commonplace again. I am sure that is an oversimplification of course.
Memories of Darkness
@GossiTheDog lol most orgs just don't care. Sad but true.
Kevin Beaumont
Leicester City Council have restored most of their services, just over 3 weeks into their #ransomware incident. Further work continues.
They say they cannot confirm if data was exfiltrated.
dwm
@GossiTheDog That is.. remarkably swift.
Kevin Beaumont
Inc Ransomware group just claimed Leicester City Council, 3tb of data exfil. I’m told it is indeed Inc.
Inc are also trying to extort NHS Dumfries and Galloway.
Inc Ransomware group need to go on the National Cyber Force shitlist.
Kevin Beaumont
Statement from Leicester City Council, they finally acknowledge their incident is ransomware and say they are informing the ICO (seems... a bit late) https://news.leicester.gov.uk/news-articles/2024/april/cyber-incident-update-3-april-2024/
Kevin Beaumont
Over 1tb of Leicester City Council docs have been published. https://www.bbc.co.uk/news/uk-england-leicestershire-68777506
Good on them for not paying. This ransomware group should be high on the shitlist at the NCA and GCHQ. #threatintel
Kevin Beaumont
Street lights are on 24/7 in Leicester due to month+ long ransomware incident https://www.leicestermercury.co.uk/news/leicester-news/leicester-street-lights-stuck-day-9240197
Kevin Beaumont
On Thursday, my monitoring triggered for Leicester City Council’s network going offline again:
2024-06-07 21:03:32
They’ve not returned online since.
Their website now has a banner which says they are having “essential maintenance works”. The list of services is the same impacted by the ransomware incident.
TheGift73
@GossiTheDog Do you know why emersonimpactpartners[.]com (IP Address of 172.67.68[.]249 seen in Indicators section when looking the the Leicester site via urlscan.io) are present?
https://www.shodan.io/host/172.67.68.249
US based company, and doesn't look like they are doing security? May not be suspicious, but was just curious as to why they have anything to do with Leicester City Council's site.
Also, the Councils site still has no CSP's
Kevin Beaumont
Leicester City Council’s services have returned to normal and note removed. #threatintel
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.