Ransomware attacks targeting cities, counties, and states have skyrocketed in recent years, including hackers going after agencies in South Florida.
Palm Springs, Jupiter, Riviera Beach, Stuart and the St. Lucie County Sheriff's Office have all been hit by ransomware attacks since 2018.
In each case, the hackers followed the same playbook: breaking into secure public records, locking them up, then demanding an extremely high ransom payment. Contact 5 found in each case, hackers broke in through a phishing email: an email that looks legit, but isn't.
"When I came to work Wednesday and I realized nothing was working on our computers, I was like, 'Wow, is it that bad?'" said St. Lucie County Sheriff Ken Mascara.
CRIME FIGHTERS, CRIME VICTIMS
The St. Lucie County Sheriff's Office was the most recent target of a ransomware attack this past December.
Hackers demanded $1 million to unlock the agency's internal files. For several days, deputies and staff resorted to pen and paper record keeping, instead of computers.
Sheriff Mascara told Contact 5 investigator Merris Badcock he never thought the agency would be the victim of crime.
"Not to this level anyway," Mascara said.
The sheriff's office lost about a week's worth of emails and other documents in the process. Months later, the agency's systems are still recovering.
But things could have been a lot worse for Mascara and his deputies had it not been for an insurance policy, purchased by Mascara a few months earlier. Thanks to the policy, insurers covered the more than $500,000 it cost Mascara for a complete system rebuild.
"As we’re seeing these attacks starting to occur more frequently, we were like, you know what? Maybe we should look into insurance," said Sheriff Mascara.
SEE ALSO: Village of Palm Springs confirms cyberattack | FBI investigating ransomware targeting city of Stuart | Security expert: Riviera Beach should have backed up data, minimizing cyberattack that cost $600K | 2016 ransomware attack against Palm Beach County Elections Office just now coming to light
Other agencies and municipalities haven't been so fortunate.
Riviera Beach was hit with a ransomware attack in May of 2019. The city ultimately paid out $600,000 to the hackers to get their files unlocked. The FBI advises against paying the hackers when hit with ransomware attacks.
Nationwide, there have been more than 400 cyberattacks against public safety and local governments in the past 24 months, according to Securelore Solutions, a cybersecurity firm that tracks these incidents.
High-profile attacks have included Baltimore and Atlanta, costing both cities millions of dollars. Earlier this month, the North Miami Beach Police Department was hit with a ransomware attack. Hackers demanded $5 million from the South Florida law enforcement agency to unlock their files.
Contact 5 reached out to 14 other cities and counties across Palm Beach County and the Treasure Coast about cybersecurity. Collectively, they are spending more than $9 million to improve their cybersecurity.
Almost everyone we reached out to said they are spending more money to make their cybersecurity as strong as possible.
GONE PHISHING
A Contact 5 Investigation uncovered that hackers targeted each of the five cities recently hit with malware attacks in the same way: a phishing email.
In December 2018, Jupiter was the victim of a ransomware attack. A phishing email was able to download a virus to part of the city's server.
"This particular email pretends to be a DHL invoice," explained Karl Craig, Director of Information Services for the Town of Jupiter.
In Jupiter's case, the city was able to restore the town's servers within 48 hours of the attack.
"Our event was well managed because we were prepared," Craig told Contact 5. "We've trained our employees to recognize this and avoid clicking on [phishing emails]. 'Just delete it.' That is our motto."
Sheriff Mascara is using his experience with the ransomware attack to educate others on what to expect. He plans to address both the Port St. Lucie and Fort Pierce city commissions about cybersecurity in the coming weeks.
"Get ready, be prepared," said Sheriff Mascara.
