Dallas County confirms cybersecurity 'incident' after ransomware gang claims attack

Dallas County experienced a cybersecurity incident this month that affected parts of its network, an official confirmed on Monday.

In a statement to Recorded Future News, Dallas County Judge Clay Lewis Jenkins said that there is an ongoing investigation into the incident following claims by a ransomware gang that emerged over the weekend.

“On October 19, 2023, Dallas County became aware of a cybersecurity incident affecting a portion of its environment. We immediately took steps to contain the incident and engaged an external cybersecurity firm to conduct a comprehensive forensic investigation,” Jenkins said.

The county is the second-most populous in the state of Texas, with 2.6 million residents. It is home to Dallas — the ninth-largest city in the country — which has already dealt with its own ransomware attack in 2023. Nearby Fort Worth has also faced off against hackers this year.

On Saturday, the Play ransomware gang posted the county to its leak site, claiming to have stolen an undisclosed amount of data, which it threatened to leak by November 3.

The group was behind the devastating attack on the government of Oakland, California — which left the city paralyzed for weeks and exposed troves of sensitive information about city residents, government officials and the local police department.

Jenkins, the Dallas County judge, said the county had brought in outside experts for help.

“Our foremost priority is the safety and security of our employees, the residents, and the public we serve. We have put in place stringent security protocols to safeguard our systems and data and are collaborating closely with our external cybersecurity specialists and law enforcement to address this situation,” he said.

“As the investigation is still ongoing, we do not want to make premature assumptions about the extent of impact or other details, which may evolve as the forensic investigation advances.”

Jenkins added that the County will provide updates once more information is available.

In May, the government of the city of Dallas faced off against the Royal ransomware gang. That attack crippled critical systems used by the city’s police, firefighters, hospitals and government officials.

For days, police, hospitals and firefighters were unable to use pivotal systems that caused chaos, and the city’s courts were out of service for weeks following the attack.

In a report on the attack released last month, the city said that from April 7 to May 2, the hackers exfiltrated nearly 1.17 terabytes of data and prepared themselves to deploy ransomware.

The recovery process cost more than $8.5 million and required federal help from the FBI, Cybersecurity and Infrastructure Security Agency (CISA) ,and more.

In July, hackers broke into a website run by the city of Fort Worth that workers use to manage their maintenance activities.

Correction: A previous version of this article said Fort Worth is part of Dallas County. It is in Tarrant County.