Mecklenburg releases ransom note from hackers who got into county servers

The ransom note sent from hackers to Mecklenburg County officials, which caused a freeze of county servers, has been released.

The county made copies of the emails available to WBTV Friday afternoon.

The note from hackers reportedly stated: “All your files have beenencrypted [sic].” Part of the ransom note said officials had 24 hours to write the hackers back to get the encryption lifted.

“You have to pay for decryption in Bitcoins,” the hackers said. “The prices dependson [sic] how fast you write to us. After payment we will send you thedecryption [sic] tool that will decrypt all your files.”

The hackers warned that officials should not attempt to decrypt the data on their own because it “may cause permanent data loss” and “may cause increased price.”

Hackers were reportedly “redoubling their efforts to penetrate the county’s systems” after Mecklenburg County officials decided not to pay a ransom to unfreeze hacked servers, officials said Thursday.

Mecklenburg County remains open for business as it continues to restore services.

According to county officials, cybercriminals tried to use emails with fraudulent attachments and viruses to further damage the county’s systems. County officials are asking residents and employees to remain patient.

County Manager Dena Diorio says hackers froze 48 county servers, and asked for two bitcoins in ransom, which totals about $23,000.

Prior to Friday’s release, Diorio and other county officials said the hackers made the demand for two bitcoins in their initial ransom letter. But the letter does not specify the amount of the ransom.

Separately, multiple sources — including at least one senior county official — have told WBTV that the hackers were actually seeking a ransom on each server, which would have run the ransom into a range of the hundreds of thousands, if not millions, of dollars.

On Thursday, officials said ITS is disabling county employees’ option to open attachments in Drop Box and Google Documents.

Officials released this statement: The county was experiencing a county-wide computer system outage Tuesday afternoon. Just after 6 p.m., officials told reporters that the servers were being held for ransom.

Officials said the repairs would take “days.” They have prioritized repairs on servers affecting health and human services, the courts, and the Land Use and Environmental Services Agency.

Diorio told WBTV that bringing the 48 servers back to full strength is a process that could go into early 2018.

“We just ask people to work with us and be patient to the best of their ability,” Diorio said.

Dioro also expects work to continue through the weekend and through the holidays.

In the meantime, they have asked customers to call departments to check on their services.

County officials say employees’ payroll will not be affected by the Dec. 15 pay date. Officials say most printers are still offline, with a limited number enabled in specific offices.

This story was originally published December 9, 2017 at 9:00 PM with the headline "Mecklenburg releases ransom note from hackers who got into county servers."