City of Dallas sets aside $8.5m to respond to a devastating Royal ransomware attack

The City of Dallas in the US state of Texas has disclosed that the Royal ransomware group infiltrated its internal systems weeks before it carried out a devastating ransomware attack in May.

Earlier this year, the City of Dallas suffered a significant ransomware attack that impacted numerous IT systems and shut down the website and communications of the Dallas Police Department (DPD). In a statement, the City said that on May 3, its security monitoring tools notified its Security Operations Centre that a ransomware attack had been launched within its environment.

The ransomware infected several servers, affecting numerous functional areas such as the police department’s computer-assisted dispatch system called CAD which directs police to emergencies and other calls. Operators were able to receive emergency calls but had to resort to manual operations and communicate with officers via phones and radios.

In a report published on September 20, city officials said that its internal investigation revealed that the Royal ransomware gang first infiltrated the City’s systems on April 7 using the “City service account credentials” and began its observation activities till May 4.

“During this time, Royal performed data exfiltration and ransomware delivery preparation activities. The data exfiltration activities performed during the surveillance period resulted in data leakages totalling an estimated 1.169 TB at a time prior to May 03, 2023.

“During the surveillance period, Royal performed several actions to inject command and control software and established command-and-control beacons” the report reads.

The City added that it had a budget of $8.5 million for restoration efforts, which covers the cost of external cyber security experts, identity theft and fraud protection services, and providers offering breach notification services to business partners and individuals affected by the incident.

It said it has developed and maintains a five-year strategic cyber security plan to ensure improved public safety, secure critical infrastructure, and smarter cities.

"In addition to the important projects and security systems that will carry over from last year’s improvements, new initiatives will be undertaken over the next three to five years to address emerging threats. This is to expand focus on identifying, protecting, detecting, responding, and recovering activities for the City of Dallas," it said.