Anchorage police department takes servers offline after cyberattack on service provider

The Anchorage Police Department said it took a range of actions to address a recent cyberattack on one of its technology service providers. 

A police department spokesperson told Recorded Future News that the incident relates to a cyberattack involving data migration firm Whitebox Technologies, which alerted the police department of a security incident on January 7. The company did not respond to requests for comment. 

The city’s IT department “shut down the relevant APD servers and disabled the vendor and all third-party service provider access.” Anchorage is Alaska’s largest city and is home to about 300,000 people. 

“Additionally, ITD oversaw the deletion and removal of all remaining APD data from the third-party service provider servers,” the statement said. “APD initiated continued oversight of its systems and will continue to closely monitor for any unusual activity.”

The police department said there “is no evidence indicating that APD systems have been compromised or that any APD data has been acquired by the threat actor.” 

But officials will monitor systems and implement “protective measures” to safeguard information. A spokesperson pledged that the police department will notify anyone potentially impacted by the incident. 

“The third-party service provider is leading the investigation into the incident. As that active investigation continues, APD, working closely with other Municipal departments, is actively overseeing the response to ensure appropriate safeguards are in place and risks are minimized,” they said. 

The police department spokesperson declined to answer questions about the nature of the incident, but said the it was not related to a recent 311 outage the city dealt with last week. 

The department statement notes that Whitebox Technologies works with "multiple agencies nationwide.” On its website, Whitebox Technologies said it has provided services to municipalities in Washington, New Jersey, Oklahoma and Maine. 

The incident comes as hackers increasingly target third-party service providers used by local governments across the U.S. In November, a ransomware gang disrupted Crisis24, which runs an emergency warning service used by dozens of U.S. municipalities.