On April 2, 2024, Jackson County tweeted that it had identified significant disruptions within its IT systems, “potentially attributable to a ransomware attack”. Jackson County is one of 114 counties in Missouri, with a population of approximately 718,000 people, mostly in Kansas City.
The tweet explains that the attack has affected systems dealing with “tax payments and online property, marriage license and inmate searches,” and says that “the Assessment, Collection and Recorder of Deeds offices at all County locations will be closed until further notice.”
The Kansas City Board of Elections and Jackson County Board of Elections are not affected. County officials also confirmed that the compromised systems did not store residents’ financial data.
“In its commitment to protect residents, Jackson County prioritizes the security of sensitive financial information and does not keep any such data on its systems. Instead, these crucial details are securely handled and stored by our trusted partner, Payit.”
On the same date an executive order declared a state of emergency. The state of emergency exists to help officials investigate and take necessary measures without the need for the usual requirements of competitive bidding. And it allows them to make appropriations from the County’s emergency fund, and additional financial adjustments, to address the requirements imposed by the emergency.
Today, the official Jackson County site says that the Jackson County offices will remain closed through Friday April 5.
Even though it looks like the county had its emergency plans ready and the county associates, especially those within the IT department, played a critical role in mitigating the impact of the attack, the impact of such a ransomware attack is not to be underestimated.
The County is investigating the security breach with the help of law enforcement agencies and cybersecurity experts. So far, there is no information available about the ransomware group that is behind this attack, but we’ll keep you posted.
How to avoid ransomware
- Block common forms of entry. Create a plan for patching vulnerabilities in internet-facing systems quickly; and disable or harden remote access like RDP and VPNs.
- Prevent intrusions. Stop threats early before they can even infiltrate or infect your endpoints. Use endpoint security software that can prevent exploits and malware used to deliver ransomware.
- Detect intrusions. Make it harder for intruders to operate inside your organization by segmenting networks and assigning access rights prudently. Use EDR or MDR to detect unusual activity before an attack occurs.
- Stop malicious encryption. Deploy Endpoint Detection and Response software like ThreatDown EDR that uses multiple different detection techniques to identify ransomware, and ransomware rollback to restore damaged system files.
- Create offsite, offline backups. Keep backups offsite and offline, beyond the reach of attackers. Test them regularly to make sure you can restore essential business functions swiftly.
- Don’t get attacked twice. Once you’ve isolated the outbreak and stopped the first attack, you must remove every trace of the attackers, their malware, their tools, and their methods of entry, to avoid being attacked again.
Our business solutions remove all remnants of ransomware and prevent you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.