incident · 1557187200000
Baltimore City Government RobbinHood Ransomware Attack
The city of Baltimore's government computer systems were crippled by the RobbinHood ransomware, disrupting numerous civic services.
What happened
The RobbinHood ransomware infected Baltimore's IT systems, paralyzing voicemail, email, a parking fines database, and systems used to pay water bills, property taxes, and vehicle citations. Real estate transactions were also delayed.
Technical mechanism
The attackers gained unauthorized access and deployed RobbinHood, which encrypted critical files. RobbinHood is known for exploiting vulnerabilities to disable security processes before encrypting data.
Why it matters
A high-profile example of ransomware targeting municipal governments, highlighting the vulnerabilities of aging infrastructure and the severe financial and operational costs of such attacks.
Impact
The attack severely disrupted city services for weeks. The attackers demanded 13 Bitcoins (approx. $76,000), which the city refused to pay. The estimated total cost of recovery and lost revenue exceeded $18 million.
Response
The city took systems offline, notified the FBI, and refused to pay the ransom. Recovery efforts took months, involving rebuilding servers and implementing stronger security measures.
Defensive lessons
- Municipalities must invest in modernizing IT infrastructure and replacing legacy systems.
- Implement comprehensive incident response plans for cyber catastrophes.
- Maintain robust backups and network segmentation to limit the spread of ransomware.
Evidence register
- City of Baltimore — City Provides Update on Baltimore Ransomware Attack (verified)
- U.S. Department of Justice — Iranian Man Pleaded Guilty to Role in Robbinhood Ransomware (verified)