Thanksgiving hack on North Carolina city caused leak of employee data

A city in North Carolina is warning government employees that data from its systems may have been accessed in a pre-Thanksgiving holiday incident.

The City of Hendersonville — a town of more than 15,000 located near the Blue Ridge Mountains about 30 minutes from Asheville — released a notice this week warning that a group of hackers targeted software the city uses to manage employee information. The notice does not say what software was attacked and the city did not respond to requests for comment.

“Upon learning of the issue, we began actively working with the North Carolina Joint Cybersecurity Task Force, as well as other local, state and federal law enforcement. We have also launched an investigation with third party cybersecurity professionals who regularly analyze these types of incidents,” city manager John Connet said on Wednesday.

“Based on our preliminary investigation, we have determined that the unauthorized party likely accessed the system and gained access to certain employee data for individuals hired before January 1, 2021. We believe the impact did not extend to other systems or customer data.”

Connet did not say when the investigation would conclude but added that those affected will be contacted once it is finished.

The attack on Hendersonville is the latest incident affecting a North Carolina government institution since the state became the first in the nation to ban payments to ransomware gangs.

North Carolina is one of only a handful of states that have banned government entities from paying ransoms connected to ransomware attacks and have prescribed a detailed playbook for government organizations to follow in the event of such attacks.

In spite of the ban on ransom payments, ransomware gangs have repeatedly targeted state and local government entities in the last year. A cyberattack on a North Carolina county two weeks ago forced officials to call in the state’s national guard for assistance.

A Charlotte suburb was hit with ransomware in July and Raleigh’s Housing Authority was attacked by hackers in May.

Hendersonville is also less than an hour away from South Carolina’s Spartanburg County, which dealt with its own ransomware attack in April.