Kansas state officials announced that the state's court system was hit by a “sophisticated foreign cyberattack”, the AP reports. The cybercriminals reportedly stole sensitive data and threatened to post it on the dark web in a ransomware attack that made access to records difficult for more than five weeks. The officials did not say whether the state made a ransom payment.
On Oct. 12, the state’s courts announced a temporary pause to electronic filings, raising suspicions of such an attack. The infiltration disrupted daily operations of almost all of the state’s appellate courts and most of its counties, though not in Johnson County, the state’s most populous, which operates its own computer systems and had not yet switched over to the state’s new online system.
In the weeks since the attack, access to court records has only partially been restored. Most attorneys are submitting their files "the old-fashioned way" -- on paper. A public access service center with 10 computer terminals is operating at the Kansas Judicial Center in Topeka. The Judicial Branch said it would take several weeks to return to normal operations, including electronic filing, and the effort involves “buttressing our systems to guard against future attacks.”
A preliminary review indicates that the stolen information includes district court-case records on appeal and other potentially confidential data. Those affected will be notified once a full review is complete, officials said.
What has been exposed is not yet clear. Analyst Allan Liska of the cybersecurity firm Recorded Future said no ransomware group leak site has published any information yet. If organizations don’t pay a ransom, data usually begins to appear online within a few weeks, said analyst Brett Callow of the cybersecurity firm Emsisoft. Victims that do pay often get a “pinky promise” that stolen data will be destroyed, but some are extorted a second time, he said.