by
Back on April 25, someone hacked the Lansing Board of Water & Light computers, froze files and demanded that the utility pay ransom to regain access in a crime commonly known as "ransomware."
The utility recovered, but declined to say until now whether it paid a ransom to regain access to the files, which included corporate internal communication, emails and functions for billings. No utility services or customer-employee information was compromised, the utility said.
On Tuesday night, the company conceded that it paid a ransom of $25,000 and in all, about $2.4 million to address the issue and upgrade security to avoid future attacks. The cost was "largely covered by insurance," the utility says.
General Manager Dick Peffley termed the payment “distasteful and disgusting but sadly necessary."
“We paid the ransom demanded by the cyber criminals who attacked our system so that we could unlock our administrative systems," Peffley says in a statement. "Based on our discussions with cyber-security experts, law enforcement agencies, and other organizations who have also been the targets of these types of criminals, paying the ransom was distasteful and disgusting but sadly necessary, and was the only action we could take to ‘unlock’ our system and free it from the ransomware.”
“We’ve learned in the course of this incident that we are not alone as cyber-threats have impacted many organizations. In the meantime, the BWL has made a number of improvements to help prevent a future cyber incident.”
The FBI and Michigan State Police are investigating the matter.
Ransomware is a growing problem in Michigan and around the country. More than 1,300 incidents are reported in Michigan this year, according to the FBI, which pegs the costs of ransom payouts, fixes and computer security upgrades in the state at about $2.6 million to date. Many attacks come from Eastern Europe.
