Antwerp denies negotiating ransomware payment as city disappears from leak site

A listing for the City of Antwerp was removed from the PLAY ransomware group’s leak site this weekend, despite its mayor announcing that the municipality did not pay the gang to unlock its data.

Antwerp, which has a population of just over 500,000, confirmed it had been hit by a cyberattack two weeks ago which has disrupted services including the city’s residential care centers.

Council websites, public libraries and online museum booking services were also impacted by the attack, although some may have been taken offline as a precaution.

The PLAY ransomware group, which first emerged in July 2022 targeting government entities in Latin America according to Trend Micro, threatened to begin leaking Antwerp’s stolen data on December 19, however the listing was pulled two days earlier.

Typically these extortion listings are only removed after the target makes a payment to the criminals or begins to negotiate with them, however the City of Anterp’s mayor Bart de Wever denied that either was happening.

Speaking to local news channel ATV on Sunday, Mayor de Wever said: “I can say that we didn’t negotiate, didn’t pay the ransom, and no one did for us.”

The disruptions to municipalities caused by a ransomware attack can be expensive and take months to recover from. An attack in 2020 on Hackney Borough Council in London in the United Kingdom impacted services for more than a year and cost over £12 million ($14 million) to respond to.

Dirk Delechambre, a spokesperson for the City of Antwerp, said last week that the municipality was working “day and night” on solutions to the disruption.

A number of digital services had resumed by that point, including the City of Antwerp’s email network and some citizen services.

“A number of systems and applications will gradually be able to be used again. However, getting everything fully digital again will take weeks to months,” said Delechambre.

According to The Brussels Times, as of the City of Antwerp’s de-listing on the PLAY leak site this weekend online ticket sales for museums also appear to be functioning again.