The City of Dallas has been forced to admit that the scope of last summer's ransomware attack was even wider than initially feared, affecting nearly 300 additional victims. Catherine Cuellar, the city's spokesperson, revealed that the total number of individuals whose personal information might have been compromised now exceeds 30,000. According to The Dallas Morning News, those affected include a mix of residents and city employees.
In a closed session earlier Wednesday, the Dallas City Council convened to discuss the cyberattack without revealing specifics. The council had previously met in late September to also discuss the incident, and on August 9, they voted to allocate nearly $8.6 million to remediate the damages from the attack. This sum was designated to cover hardware, software, and consulting services. The additional spending meant to further address the ransomware attack, according to Cuellar, will not seek further approval beyond this already approved sum. The city has faced criticism for not disclosing details on how these millions are being spent, despite a partial release of records mandated by the Texas attorney general's office. Officials defend this secrecy by citing an ongoing criminal investigation.
A formal notice in August alerted the public to the breach, months after the city detected the attack on May 3. The hackers, who used stolen credentials to infiltrate Dallas city servers, were linked to the ransomware group Royal. This revelation comes from documents indicating the group had access to the city network for about a month, with nearly 1.2 terabytes of data downloaded. Though the full impact remains unknown, the city claims no evidence of leaked information has been found to date.
For those impacted by the breach, the City of Dallas has offered two years of free credit monitoring, though as of Jan. 9, only 13.3% have enrolled, indicating a need to perhaps more actively alert those at risk. Such measures are cold comfort to the additional 293 people just now learning their data was also accessed, WFAA reports. The stolen information includes names, addresses, social security numbers, and even medical details, adding to the severity of the cyberattack's consequences.
As the Dallas City Council continues to navigate the fallout behind closed doors, the city's residents and employees are left grappling with the potential fallout of their exposed data. Letters notifying the newly discovered victims are being sent, but with the city's overall transparency on the issue remaining opaque, trust in its ability to safeguard against and respond to such threats is being called into question.
