Councilman Says Recovery From Ransomware Attack Could Take Up To Three Months

A Baltimore City councilman said Wednesday he's been told recovery from the ransomware attack on city government could take anywhere from three weeks to three months.

"It's been, I would say, frustrating--from the government side, it's been very frustrating," 4th district Councilman Bill Henry said. "I'm sure it's just as if not more frustrating from the side of constituents who are trying to reach us."

Hackers demanded 13 Bitcoin. At the start of the hack, that was equivalent to around $75,000. However, the same amount of Bitcoin ran more than $100,000 on Wednesday.

As the outage drags on, city permits and real estate deals are being held up. City officials have no date for when systems will be back up. Real estate transactions should resume late next week, and it's safe to use city websites even as city systems remain down.

Latest on Baltimore City ransomware attack:

No date for when systems expected

to be back up

Real estate transactions should resume "late next week"

Safe to use City websites, officials say

No answer as to firms that have been hired to assist pic.twitter.com/as2eIK9t6I — Jayne Miller (@jemillerwbal) May 15, 2019

The FBI says it's possible the ransomware attack is connected to other cities.

The attack happened days after Mayor Bernard C. "Jack" Young officially took over for former Mayor Catherine Pugh, and just after Brandon Scott was elevated as City Council president.

"Happening as it has during a point of leadership transition with now Mayor Young and now council President Brandon Scott, it has added an extra dimension to the difficulty on an internal basis as we try to figure out not only how to reach staff people to help us get problems solved for our constituents, but also at the same time we're adjusting to who are the staff people we should be reaching out to because some positions are changed," Henry said.

He said he hopes that the timeframe he was given accounts for both service restoration and an investigation into the hack's origins, and that service will be restored closer to the three-week end.

"My expectation is... that at some point in the three week to three month range, the damage will be repaired and that they will continue on," Henry said, adding that city officials are taking the opportunity to perform extensive repair and replacement work they otherwise wouldn't have the opportunity to do.

Former Mayor Sheila Dixon told C4 on Wednesday that she would pay the ransom first, citing the number of services affected, then work to make sure it never happens again.

"And I would write the check and give them the money so that we can get things back up and running," Dixon said.

Though Dixon conceded she isn't an expert in network security, she said employees have to be educated on safe use of city technology, and city systems need to be regularly backed up.

A spokesman for the FBI's Baltimore field office, however, said the agency doesn't support paying a ransom to hackers.

"Paying a ransom doesn't guarantee an organization that it will get its data back-there have been cases where organizations never got a decryption key after having paid the ransom," spokesman Dave Fitz said. "Paying a ransom not only emboldens current cyber criminals to target more organizations, it also offers an incentive for other criminals to get involved in this type of illegal activity. And by paying a ransom, an organization might inadvertently be funding other illicit activity associated with criminals."

Like WBAL on Facebook Download the WBAL Smart Phone App ?

Anne Kramer and Phil Yacuboski contributed to this report.