Civic News
Cybersecurity / Municipal government

Cybersecurity expert on ‘Robbinhood’ ransomware attack: Recovery could take months

On day two of the Baltimore city's systems being shut down, here's a look at what's known about the attack, and the ransomware behind it.

Baltimore City Hall. (Photo via Wikimedia Commons)

The ransomware being used in an attack on the City of Baltimore’s IT systems was identified as “Robbinhood.”

At a news conference on Wednesday, Chief Information Officer Frank Johnson said the attack was discovered early Tuesday, shutting down the “majority” of the city’s servers, though emergency services remained available.

The FBI is investigating, and “has confirmed that it’s a fairly new variant that is quite aggressive,” Johnson said. “Technicians right now are trying to remediate the root cause,” as well as what’s been impacted and affected.

With systems down, city employees are reverting to manual processes. Mayor Bernard C. “Jack” Young said all employees still reported to work, however, and expressed confidence in the city’s team to resolve the issue.

“If we are in this for longer than we anticipate, I’ll be asking city employees who really can’t do their work because of the computer systems, would they be willing to go out and help us clean up the city,” Young said. (It’s not clear if he meant “clean” literally.)

Ransomware is a type of malware in which attackers use encryption to prevent access to a system. The attackers often demand a payment to reopen access.

Separate from the officials’ comments, reached out to Todd Weller, chief strategy officer with Columbia cybersecurity firm Bandura Cyber, to learn more about how this type of attack can affect cities.

As for RobbinHood in general, Weller said it’s a “relatively new strain of ransomware, which first appeared in mid-April. There is still a lot of work being done to understand the details of how this threat works.” For example, it’s still unclear how the ransomware enters a network and infects computers.

As demonstrated by the employees reverting to manual processes, the impact of an attack can be widespread.

“What we have seen from incidents like the city of Atlanta and Baltimore is that critical and non-critical systems are taken down, which negatively impacts normal operations. These negative impacts could often result in the unavailability of services or degradation of service delivery quality,” he said.

Even as the emergency services remain operational, the quality of service can be affected. And as seen with agencies such as the departments of public works, housing and recreation, the impacts can extend to other business operations.

The timeframe for recovery from such an attack is weeks to months, Weller said.

“The city of Atlanta was still being impacted several months after the ransomware attack, with the finalization of its annual budget impacted,” he said.

Before you go...

Please consider supporting to keep our independent journalism strong. Unlike most business-focused media outlets, we don’t have a paywall. Instead, we count on your personal and organizational support.

Our services Preferred partners The journalism fund

Join our growing Slack community

Join 5,000 tech professionals and entrepreneurs in our community Slack today!


Inside Maryland’s latest effort to support emerging businesses

As a returning citizen, she experienced tech overload. Now she’s fighting to end the digital divide

A Baltimore entrepreneur’s new platform aims to topple tech silos

This Week in Jobs: The kernel of a new career is in these 20 tech opportunities

Technically Media