City of Oakland denies it suffered a second ransomware attack in February

The City of Oakland has refuted reports about experiencing a second cyber attack allegedly carried out by the notorious LockBit ransomware group.

The City of Oakland suffered a ransomware attack on February 8 that resulted in a network outage, forcing it to take all IT systems offline and declare a local state of emergency for a week.

On March 1, the infamous Play ransomware gang listed the city as a victim on its extortion site and threatened to make the documents public unless a ransom was paid. According to the threat actors, the stolen documents included private and sensitive information, financial and official records, identity documents, passports, individual employee data, and even information purportedly demonstrating human rights violations.

The notorious LockBit ransomware gang joined the party last week by listing the City of Oakland as a victim on its data leak site. The threat group said in a post that the city has been given a deadline of April 10 to meet its demands, failing which it will publicly leak the stolen data.

The city has, however, refuted the claims of the infamous ransomware gang, stating that it has no evidence of a second ransomware attack.

“We are aware that another unauthorised actor claims to have access to data removed from the City of Oakland’s systems. Our investigation with cybersecurity professionals and federal law enforcement remains ongoing. Based on our investigation so far, we have no indication there was additional unauthorised access of our systems. We will continue to provide updates as appropriate,” the City said.

It’s not clear yet whether Lockbit has compromised the same vulnerability that the Play ransomware gang did to infiltrate the City’s systems, but the Lockbit ransomware group is known to falsely claim some attacks on its data leak site.

The City of Oakland is in the process of notifying current and former employees whose sensitive personal information was compromised in the ransomware attack it suffered last month.

“If you were a City employee (i.e., on City payroll) between July 2010 and January 2022 and have not received a notice, we encourage you to contact cyberfaq@oaklandca.gov with any questions about potential impacts to your data and resources available to you,” the City added.