Pierluigi Paganini May 08, 2024

The LockBit ransomware group has added the City of Wichita to its Tor leak site and threatened to publish stolen data.

Last week, the City of Wichita, Kansas, was the victim of a ransomware attack and shut down its network to contain the threat.

Wichita is the most populous city in the U.S. state of Kansas and the county seat of Sedgwick County. As of the 2020 census, the population of the city was 397,532.

The security breach took place on May 5th, 2024, and the City immediately started its incident response procedure to prevent the threat from spreading.

The City is investigating and containing the incident with the help of third-party security experts and federal and local law enforcement authorities.

“We regret to report that certain online City services may be unavailable as we thoroughly review and assess an incident that affected some of our computer systems. As part of this assessment, we turned off our computer network.” reads the security breach notification. “This decision was not made lightly but was necessary to ensure that systems are securely vetted before returning to service.”

The City warned that some services may be temporarily unavailable while systems are offline.

The City hasn’t disclosed the family of ransomware that infected its systems and the name of the extortion gang behind the attack.

“We are working with specialists to thoroughly review and assess systems before putting them back online. Systems will be restored on a staggered basis to minimize disruptions. We do not have a definitive timeline for returning all systems to production.” the city noted.

“This [the name of the group that is claiming responsibility for the attack] is not being shared for operational security purposes.” states the report.

However, the LockBit ransomware gang claimed responsibility for the cyberattack on the City of Wichita.

The deadline for the ransom payment is May 15, 2024.

The City is still facing disruptions caused by the attack.

“The information technology department and its security partners continue to work around the clock to address the cyber security incident. Many City systems are down as security experts determine the source and extent of the incident. There is no timetable for when systems could be coming back online. We appreciate your patience as we work through this incident as quickly and as thoroughly as possible.” reads an update published by the City.

The extortion group claimed responsibility for the attack after law enforcement agencies unmasked and sanctioned the leader of the LockBit group, Dmitry Yuryevich Khoroshev, aka LockBitSupp.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, City of Wichita)