Play ransomware group targets US City of Lowell, demands a ransom

The Play ransomware group has listed the City of Lowell in Massachusetts as a victim on its dark web site and has threatened to leak data it stole from the City unless a ransom is paid.

On April 24, the City of Lowell suffered a significant cyber attack that impacted the municipality’s computer systems. The incident brought down services like phones, emails, and other city systems.

City Manager Tom Golden said that 911 and other emergency numbers were unaffected, and the City found no evidence of a data breach. Also, the incident was not classified as a ransomware attack. 

 

The city’s online Invoice Cloud payment platform continued to accept payments for real estate, personal property, motor vehicle excise, water utility, vital records, burial permits, cemetery lot purchases, and other services. However, payments made took some time to reflect on the systems.

The attack was reported to law enforcement by City officials and according to Golden, it will take days for the city’s system to become fully operational.

Recently, the notorious Play ransomware group claimed responsibility for the cyber attack and listed the city as a victim on its data leak site. The group claimed to be in possession of sensitive City documents like personal data, passports, government IDs, financial documents, budgets, departmental files, and more. The group has threatened to publish the stolen data on May 10 unless its ransom demands are met.

In an update posted on April 27, the city of Lowell said that “MIS successfully enabled telephone services at City Hall, and continues to work on doing so at other City sites. This continues to be an ongoing investigation with multiple state and federal agencies involved, who are helping us with the forensic assessment of the cyber-related incident.”

The Play ransomware group was also responsible for targeting the US City of Oakland and leaking around 600 GB of data on the dark web, a month after it published 10 GB of data stolen from the City. 

 

The trove of data leaked by the group included files belonging to Oakland city police and sensitive information like internal investigations and disciplinary records.