City of Dallas Continues Battling Ransomware Attack for Third Day

Some services and websites were still crippled Friday in the third day of a ransomware attack on the Dallas City Government.

No one has publicly revealed the ransom that’s being demanded to end the attack or whether any ransom has been paid. Experts said the demand could be very expensive.

Computer dispatch was still down in the Dallas 911 call center. Police and firefighters were sent to calls by radio using paper and pencil for addresses.

Code enforcement and other non-emergency response to 311 calls were delayed.

City water bill payments were impacted. Disconnections were canceled.

The city website offered some information about meetings but little more.

“According to this government alert a few months ago, this group asked their victims for between one and ten million dollars in bitcoin,” said Kevin Collier, an NBC News reporter on cyber security issues.

Southern Methodist University cyber security expert Mitch Thornton agreed the ransom demand could be that large.

“It certainly is within the range of what I’ve heard from these ransoms,” Thornton said.

City officials have said the attack is from a group called Royal. In a statement late Friday, the city said city information technology employees and vendors have worked to contain the virus and restore service. The statement said progress has been made but recovery is ongoing.

Outside experts said the Royal ransomware has been evolving as defense efforts worked to stop it.

Training warns employees not to click on suspicious emails that could unleash ransomware.

Thornton said corrupt online ads can now be a culprit in a scheme called “malvertising.”

“There’s increasingly better screening in our email readers so these threat actors can get around that by placing these ads on web pages when you are browsing around,” he said. “I’m not saying that’s what happened here but there have been cases of the Royal ransomware being distributed through these malvertisments.”

“Ransomware is becoming really big amongst hackers because it works; because people really do pay the ransoms,” said Paul Bischoff with the cyber security website Comparitech.com.

His site published a list of $70 billion worth of U-S government ransomware payments reported between 2018 and 2022.

“Our estimates are probably a lot lower than what is really happening because people are not reporting it to the FBI,” Bischoff said.

The extortion threat could be public release of seized confidential information or stopping service delivery, which has occurred in Dallas.

“Ransomware actors are using multiple extortion types,” Thornton said.

According to NBC 5's media partner The Dallas Morning News, the Dallas Central Appraisal District paid over $170,000 to end a Royal ransomware attack that lasted for months, crippling the organization's public access website.

“Cyber criminals are likely based in Russia. If they were based in the United States we could put handcuffs on them quickly, but they’re not. We have no access to them so it’s much more difficult to shut them down,” Collier said. “It’s largely Russian organized crime extorting Americans essentially daily and there’s not a ton of recourse.”

The Dallas City Council Public Safety Committee is due to receive a report on the attack Monday but since it is an ongoing investigation that may include ransom negotiations, much of it will likely occur in a closed-door executive session.

The agenda for that meeting was available online Friday.

---

Here is additional information the City of Dallas released about the attack Friday:

911 and 311 calls are being answered and Dallas Police Department and Dallas Fire-Rescue are being timely dispatched by radio.

For residents with non-emergency needs, 311 is still taking service requests by phone but the OurDallas app and online portal are temporarily unavailable. Another option is service in person at City facilities during regular business hours.

Sanitation collection remains on schedule and disposal sites are operational during regular business hours. If service is missed, please call 311.

Dallas Water Utilities service is unaffected, and disconnections are discontinued until the outage is resolved. Statements may be paid by mail; however, for those who prefer to pay in-person or online, late fees will not be charged for payments that cannot be processed until service is restored. DWU autopay will draft when service is restored. If you have questions or need assistance, please call (214) 651-1441 or walk into the water lobby at City Hall Monday through Friday between 8 a.m. to 5 p.m.

Office of Community Care clinics for Women, Infants and Children (WIC) are open and providing benefits. Vital Statistics is issuing records, but to ensure any records sought are available before you arrive, please call 214-670-3092.

Dallas Public Library branches are open, operational, and can check out media to residents with a library card; however, residents with media due to be returned are asked to hang on to it a little longer. There will be no late fees charged for materials due during the service outage. Digital media is also available via Hoopla and Overdrive. Internet-connected computers may be limited, so users in need of online device access should call ahead to their respective branch.

Dallas Animal Services continues handling adoptions, fosters, rescues, and returns to owners in-person on a case-by-case basis at 1818 N. Westmoreland Road, 75212.

Code Compliance is issuing garage sale permits only in-person at their headquarters at 3112 Canton Street, 75226. 

While pages on the City’s website are being restored, Special Events permit requests may be submitted through the following direct links:

• Special Event, Commercial Promoter, and Fair Park Parking License Application
• Street Pole Banner Application
• Commercial Filming
• Neighborhood Market

Development Services can review paper plans for walk-ins at 320 E. Jefferson Blvd., 75203 during regular business hours. However, while Permitting, Public Works, and Zoning application and payment systems are offline, submissions cannot be received or approved. This is a dynamic situation, and patience is appreciated while we focus on expediting full-service restoration.

Municipal Court remains closed Monday, May 8. There will be no court hearings and no trials. Cases scheduled during this outage will be reset, and updates will be mailed. Citation payments and documents due while Municipal Court is closed will be accepted after service is restored.

Please note, no one from the City of Dallas will reach out to members of the public to ask for payment in person or by phone. Never give out your password or payment information by phone or through an email link.

To protect against cyber threats please install the Dallas Secure app on your iOS or Android device. If you are contacted by someone seeking payment who claims to be from a City of Dallas department, please take note of the number they are calling from and the number they reached you on, then hang up and call the City of Dallas department they claim to be from to report this potential impersonation.