Cyber ​​incident forces Cleveland to close city hall

Cleveland closed its city hall on Monday as authorities investigate a cyber incident that affected some systems.

In a statement to Recorded Future News, a city spokesperson declined to say which systems were shut down due to the incident, but confirmed that police, fire and rescue services, and the emergency dispatch center are still functioning. Systems controlling local ports and public utilities are also unaffected.

“As long as the city’s systems remain offline, all 311 calls during the day will be handled by after-hours phone services,” the spokesperson said. “All internal systems and software platforms will be shut down until further notice.”

On Monday, only essential staff will be present at City Hall and all affected systems will remain offline until there is “a better understanding of the situation.”

“We take cyber threats extremely seriously and are working quickly to resolve the situation as quickly as possible,” the spokesman said.

When asked if it was a ransomware attack, city officials did not respond. They said they had not yet confirmed the “nature and scope” of the incident but were focused on securing and restoring services as securely as possible.

Cleveland, with its population of almost 400,000, is the latest major city in the United States to have all services shut down following a cyber incident.

Wichita, the largest city in Kansas, was forced to accept only cash as a form of payment last month after a ransomware attack not only disrupted city services but also leaked vast amounts of police documents onto the dark web.

Last week, a new ransomware operation leaked data stolen in an attack on the city of Pensacola, Florida, earlier this year, highlighting how difficult it is for law enforcement to dismantle the gangs behind attacks on local governments.

Several Ohio cities have been targeted by ransomware gangs over the past two years, including Huber Heights, Mount Vernon, Circleville, and others. Even the state’s lottery system was attacked by ransomware actors in December.

Learn more.