CLEVELAND — The city of Cleveland has announced that "after addressing the recent cyberattack" on its systems, City Hall will "resume select operations" this Thursday starting at noon.
The reopening comes after a cyber incident impacted the city's IT operations for most of last week. Officials later deemed the incident to be a ransomware attack, a development that was first reported by 3News Investigates.
In a statement given to 3News on Wednesday, Cleveland Chief Communications Officer Sarah Johnson says the city does not intend to pay off the ransom hackers.
"The City of Cleveland is a victim of a crime, and we are actively investigating the attack on our community," Johnson said. "As a matter of security, we can not share the details of the demand; only that it was ransomware. We are not actively negotiating with the attackers, and we do not intend to respond to their requests. At this time, we have no intent of paying the ransom."
According to a release from the Bibb administration, available services at the reopened City Hall will include Building & Housing, Assessments/Licenses, and Vital Statistics. The city adds that "civil service examinations are operating normally and regular meetings are being held unless otherwise notified."
For other business, residents are advised to call 311 for a status update before coming in.
"Despite the temporary closure of City Hall, essential city services, including Public Safety, waste collection, recreation centers, operations at the airport, Cleveland Public Power, Water and Water Pollution Control, have been operating normally to ensure the continued wellbeing and safety of our residents," the city added in its release.
Officials have also provided the following tips to make your business at City Hall "as smooth as possible":
- Please be patient: Things may be slow, and we expect lines for service
- Use online options when possible: Systems that are up and running are safe to use
- Building & Housing customers are asked to use the Accela portal to upload documents. Please do not bring in hardcopies as we are unable to scan documents at this time.
3News Investigates also obtained the below email from City Hall to city of Cleveland employees:
"After a thorough investigation by our IT Department, led by Commissioner Kim Roy Wilson and external cybersecurity experts such as the FBI and the Ohio National Guard’s Cyber Reserve Unit, we can confirm that the cyber incident that disrupted the City of Cleveland’s IT systems is a ransomware attack. The nature of the attack is still under investigation while we work to restore and recover our systems. At this time, we cannot disclose anything further, as this is a sensitive investigation."
3News Investigates has viewed screenshots of city computers that appeared to be infected by malicious software, with signs that this malware is associated with a known Russian cyber gang accused of carrying out ransomware attacks elsewhere in the country.
WKYC is not naming the cyber gang, but according to the FBI, the group has previously used ransomware to encrypt and lock victims' files before demanding a ransom in exchange for the decryption key. The cyber gang has been blamed for multiple attacks on U.S. businesses and government entities.
Previous Reporting:
- Cleveland City Hall closed Tuesday as city continues to investigate ransomware attack
- City of Cleveland confirms 'cyber incident' impacting IT systems is due to ransomware attack; City Hall to be closed to public Monday
- 3News Investigates: Cleveland City Hall was the victim of a cyber attack; signs point to known cyber gang