Nassau Bay in Texas says ransomware attack compromised residents' personal and financial data

The City of Nassau Bay in Harris County of Texas said it suffered a ransomware attack that compromised residents’ personally identifiable information and data associated with their financial accounts.

In an official notification filed with the Maine Attorney General’s office, Nassau Bay, a city in Harris County, Texas, said it was a victim of a “data security incident that caused the encryption of certain systems and files.” According to city officials, a cyber security incident was identified on May 23 and an internal investigation was immediately launched to understand the nature and scope of the incident.

“As soon as we became aware of the issue, we launched an investigation, contained and secured the network, eradicated the threat and alerted law enforcement. As part of the investigation, we engaged third-party cybersecurity professionals experienced in handling these types of incidents.

“The investigation aimed to determine the nature and scope of the incident and whether any personal information was accessed and/or acquired by the unauthorised party,” the City said.

“After a thorough and detailed forensic investigation, we concluded the unauthorised party removed a number of files from our network on May 23, 2023. Upon learning this, we immediately conducted an extensive and comprehensive review of the impacted files and, on October 16, 2023, we discovered that some of the files contained your personal information,” the City added.

The compromised data includes the sensitive personal information of city residents, including their names and other personal identifiers, financial account numbers, credit and debit card numbers along with its security codes, access codes, passwords and PIN for the accounts.

The filing with the regulator also confirms that at least 8,839 individuals have been affected by the incident. The City said it found no evidence of the compromised information being misused, but has asked all affected individuals to remain vigilant and monitor their credit reports and financial statements regularly. Complimentary credit monitoring and identity theft protection services have not been offered to the impacted individuals.

The infamous Akira ransomware group recently claimed responsibility for the ransomware attack on the City and listed the same on its data leak site. The group claims to be in possession of 45GB of personal data stolen from the City’s internal network and has made it available for anyone to download from the dark web.

 

“Nassau Bay is an incomparable community at the leading edge of technology. But being on the edge is dangerous sometimes. The city government says that they don’t have evidence that the personal information has been compromised. We are willing to provide some evidence,” the ransomware group said in a post on its data leak site.