Chicago police pay 2 BTC ransom to unencrypt their files

[fed]

A south suburban police department paid a $500 ransom to an unidentified hacker to regain access to data from a police computer the hacker managed to disable, records show.

Midlothian in January was hit with a form of computer virus called Cryptoware, said Calvin Harden Jr., an IT vendor who works with the village.

The hacker demanded payment through bitcoin, a digital currency often used by individuals engaging in sophisticated or sometimes illegal activities on the Internet.

"It didn't encrypt everything in the police department. It was just that computer and specific files," not the entire system, Harden said.

The hacker didn't access the information on the computer but merely shut it down and made it inaccessible, Harden said.

The Federal Trade Commission and the FBI issued a public warning last year to consumers and businesses about the virus, saying it's "essentially extortion." Midlothian's police force isn't the first government agency to fall victim to the cybercrime.

The city of Detroit and a Tennessee sheriff's office both encountered Cryptoware hackers who sought ransoms in the past year, according to published reports.

Fred Hayes, Elwood's top cop and president of the Illinois Association of Chiefs of Police, said this type of virus is becoming more common and that federal officials have been in touch about it. His advice to departments is to back up their data.

"This is something that quite a few people recently, and when I say recently (I mean) over the last year or two, have been experiencing," Hayes said.

At the Midlothian Police Department, someone opened an email that contained the virus, allowing the virus to lock down the computer, Harden said. A message popped up on the machine demanding money in exchange for a virtual code that would return access, Harden said.

Midlothian Police Chief Harold Kaufman confirmed that the department had been hacked but otherwise declined to comment.

Neither Kaufman, Midlothian's mayor, nor the village clerk returned further messages asking whether the village would pursue the hacker, but Harden said he believed officials would do so. An FBI spokeswoman wouldn't confirm whether the village made the FBI aware of the incident.

Village officials released a copy of the town's invoice in response to an open records request by the Tribune. The invoice, "for MPD virus," shows the village sent a $606 money order to a bitcoin cafe in New York to transmit the money to the hacker. The payment included bank fees and surcharges.

Officials tried to wire the money through Bank of America, Harden said, but couldn't.

The village had to make a difficult decision whether to comply with the demand, Harden said, and chose to because a pursuit of the hacker might have been more trouble than it's worth.

"Because the backups were also infected, the option was to pay the hacker and get the files unencrypted," Harden said, "which is what we decided to do."

Harden said he believes the hacker's actions are criminal, which is why the hacker requested "pretty much untraceable" bitcoin as payment.

The sheriff's office in Tennessee paid $572 to a hacker known as Nimrod Gruber to regain access to its files, according to reports. Detroit's mayor said in November that the database that was frozen there wasn't essential to government operations, and the city refused to pay a ransom of several hundred thousand dollars a hacker sought.

Mike Alsup, co-chair of the Communications and Technology Committee for the Illinois Association of Chiefs of Police, said the issue of cyber security "weighs heavily" on police chiefs.

"Chiefs across the entire nation are concerned with the growing trend of computer crime," Alsup said. "Hardly a day goes by that we don't see in both the print and audio media, we hear of instances of computer crime, computer hacking, large organized criminal groups internationally that are stealing through the use of computers."

Harden, Midlothian's IT vendor, said he does work for a law firm that experienced a similar virus last year, and added that it's "happening to people every day."

"When you tell someone this, it's sort of they're like, 'What?' It's sort of a crazy scenario," Harden said. "But it's happening."

Midlothian cops pay bitcoin ransom to retrieve data from hacker - Chicago Tribune