Play ransomware gang leaks 5GB of Dallas County data following non-payment of ransom

The infamous Play ransomware group has leaked approximately five gigabytes of data it allegedly stole from Dallas County’s systems in October after the county refused to pay a ransom.

The Dallas County in the US state of Texas admitted that it recently suffered a significant cyber attack that affected certain parts of its computer network.

In a statement shared with the media, Dallas County Judge Clay Lewis Jenkins said, “On October 19, 2023, Dallas County became aware of a cybersecurity incident affecting a portion of its environment. We immediately took steps to contain the incident and engaged an external cybersecurity firm to conduct a comprehensive forensic investigation.”

“Our foremost priority is the safety and security of our employees, the residents, and the public we serve. We have put in place stringent security protocols to safeguard our systems and data and are collaborating closely with our external cybersecurity specialists and law enforcement to address this situation.

“As the investigation is still ongoing, we do not want to make premature assumptions about the extent of impact or other details, which may evolve as the forensic investigation advances,” Judge Jenkins added.

The infamous Play ransomware group has claimed responsibility for the cyber attack on Dallas County and listed the latter as a victim on its data leak site. According to screenshots shared by cybersecurity analyst and security researcher Dominic Alvieri, the group listed the county as a victim on October 28 and claims to be in possession of “private documents of Dallas County”.

The ransomware group gave a deadline of five days, that expired on November 3, for the county to meet its demands, failing which it said it would publish the stolen data.

According to screenshots shared by Brett Callow, a threat analyst at Emsisoft, the ransomware group has published five gigabytes of compressed files and said it would publish more “if there is no reaction.” The group is, however, yet to disclose how much data it has exfiltrated from the County’s internal network or the nature of the same.

Officials from Dallas County said that they are in the process of reviewing the data published by the Play ransomware group.

In a statement shared with Recorded Future, Dallas County Judge Clay Lewis Jenkins, said, “We are currently in the process of thoroughly reviewing the data in question to determine its authenticity and potential impact. Our investigation into the incident remains ongoing and we continue to work closely with law enforcement and our cybersecurity experts to address this situation.”

This statement, however, contradicts the statement that County officials previously shared with the media in which they said that the data exfiltration was interrupted by the County’s IT team.

“Due to our containment measures, Dallas County interrupted data exfiltration from its environment and effectively prevented any encryption of its files or systems. It appears the incident has been effectively contained, partly due to the measures we have implemented to bolster the security of our systems,” the officials had previously stated.

The City of Dallas also suffered a major ransomware attack by the Royal ransomware group in May this year. The City noted that the ransomware group exfiltrated more than 1 TB of data from its servers, including the personal information of 26,212 Texas residents and the City had to set aside a budget of $8.5 million to fund remediation efforts.

"The Dallas City Council has approved a budget of $8.5 million in computer-based interdiction, mitigation, recovery, and restoration efforts directly tied to the Royal ransomware attack. This sum includes external cybersecurity professional services, identity theft and fraud protection services, and providers offering breach notification services to business partners and individuals that experienced data exposure due to the attack," the Dallas City Council said.