Dallas County

Dallas County, Texas, experienced a cybersecurity incident that began on October 19, 2023, when officials became aware of a cyberattack affecting a portion of the county’s systems. The ransomware cybercrime organization known as “Play” claimed responsibility for the attack. In response, Dallas County took immediate steps to contain the breach and engaged an external cybersecurity firm to conduct a comprehensive forensic investigation[1][2][6].

The county implemented several security measures to mitigate the impact of the attack, including the extensive deployment of an Endpoint Detection and Response (EDR) tool, forcing password changes for all system users, requiring multi-factor authentication, and blocking traffic from malicious IP addresses[1][3][5]. These efforts successfully interrupted data exfiltration from the county’s environment and prevented any encryption of files or systems, which is a common goal of ransomware attacks[5].

Despite these containment measures, data allegedly taken from Dallas County’s systems was posted online, and officials were reviewing the data to determine its authenticity and potential impact[1][2]. The specific data accessed or posted was not immediately clear, but the county committed to notifying affected individuals directly if personal information was involved and to providing updates as more information became available[1][4].

The cyberattack on Dallas County is part of a larger trend of breaches targeting local governments in Texas and across the nation. Earlier in 2023, the City of Dallas and the City of Fort Worth also experienced cyberattacks, with varying degrees of sensitivity in the information accessed[2][3].

Dallas County Judge Clay Jenkins emphasized the seriousness with which the county was taking the incident and the priority placed on the security and privacy of all individuals associated with Dallas County. The investigation into the incident remained ongoing, with the county working closely with law enforcement and cybersecurity experts[1][4].

Residents and employees were encouraged to visit the Federal Trade Commission’s website for information on how to safeguard personal information and to check the county’s webpage for updates on the incident[1][10].

Citations:

1. https://www.wfaa.com/article/news/local/play-dallas-cyber-security-attack-released/287-a15c6bda-9524-4a7b-ad9d-441065c14087
2. https://www.keranews.org/news/2023-11-07/dallas-county-trying-to-find-out-if-claims-that-hacker-group-posted-its-data-online-are-true
3. https://www.nbcdfw.com/news/local/dallas-county-officials-reported-tuesday-on-their-defense-against-a-cyber-attack/3374977/
4. https://www.dallasobserver.com/news/hackers-claim-theyve-leaked-dallas-county-data-17840750
5. https://statescoop.com/dallas-county-texas-prevented-encryption-ransomware/
6. https://www.nbcdfw.com/news/local/dallas-county-targeted-in-cyber-attack-forensic-investigation-underway/3373824/
7. https://www.keranews.org/government/2023-10-30/dallas-county-cyber-attack
8. https://www.cbsnews.com/texas/news/cyber-terror-group-play-says-it-stole-thousands-of-files-from-dallas-county/
9. https://www.govtech.com/security/hackers-claim-to-have-breached-dallas-county-government
10. https://www.dallascounty.org/about-us/hot-links/notice-cybersecurity-incident.php
11. https://www.dallasnews.com/news/crime/2023/10/30/cyberhackers-report-stealing-dallas-county-data/