Skip to main content

Ransomware Attack Caused Power Outages in the Biggest South African City

cyber attack cause power outage
Yesterday, some residents of Johannesburg, the largest city in South Africa, were left without electricity after the city's power company got attacked by a ransomware virus.

City Power, the company responsible for powering South Africa's financial capital Johannesburg, confirmed Thursday on Twitter that it had been hit by a Ransomware virus that had encrypted all of its databases, applications, and network.

The attack prevented prepaid customers from buying electricity units, upload invoices when making payments, or access the City Power's official website, eventually leaving them without power.

"Please note that the virus hit us early Thursday morning, compromising our database and other software, impacting most of our applications and networks," the city government said in a tweet.

However, the company has also ensured its customers that none of their details were compromised in the cyber attack.

At the time of writing, the company confirmed they have restored electricity supply in many areas and also most of the critical applications, including the prepaid vending system responsible for enabling its customers to buy electricity.

However, customers seeking to access the City Power website to log faults are still not able to do so. They are requested to log calls by their mobile phones using citypower.mobi.

Depending on the type and severity of the cyberattack, it is believed that the complete clean up of the affected services and networks could take weeks.

Also, it could cost millions of dollars—just like the City of Baltimore recently spent $5,310,546 in hiring security consultant firms and upgrading its infrastructure following a ransomware attack that shut down the majority of its servers.

The city government did not provide any details on the type of ransomware virus that hit the power company, or if the company has a backup for critical files encrypted by the malware.

"Customers should not panic as none of their details were compromised," the city government saidThursday afternoon. "We apologize for the inconvenience caused to the people of the City of Joburg. Please be patient with us, and we expect to have everything back in order by the end of Thursday."

Johannesburg is not the only one that was recently hit by a ransomware attack. A growing number of cities has targeted in the last few months with ransomware as cybercriminals aim municipalities around the world.

Last month, ransomware viruses hit two cities in Florida that made large ransom payments to gain back access to city files that were encrypted in the attacks—these cities include Riviera Beach City ($600,000) and Lake City ($500,000) in Florida.

However, federal authorities and cybersecurity experts have always advised victims not to pay ransoms since it encourages criminals, and also there's no guarantee of files or computer systems being completely restored.

Instead of paying the ransom, organizations and companies should consider having robust backups of their important and required files and data in place as well as educating their employees to avoid being a victim of such cyber attacks.

Comments

Popular posts from this blog

Applications and Threats Content Release Notes

  Threat Intelligence Report Top Attacks and Breaches The biochemical systems at an Oxford university research lab currently studying the Covid-19 pandemic has been  breached . Clinical research was not affected by the incident. Breached systems include machines used to prepare biochemical samples, and hackers are currently attempting to  sell  their access to those machines. Twitter has permanently  suspended  multiple accounts found to be part of four disinformation campaign networks, most likely operated by state-sponsored actors associated with Iran, Russia and Armenia. The Iranian infrastructure was previously used to disrupt the 2020 US presidential campaign discourse. Gmail accounts of global pro-Tibet organizations have been  targeted  by the Chinese APT TA413, an espionage group known for its operations against civil dissidents. The campaign leverages a customized malicious Mozilla Firefox browser extension to gain control over the victims’ Gmail accounts. Npower, a British ga

Cisco Releases Security Updates for Cisco ASA 5506-X, 5508-X, 5516-X and Firepower// Cisco Bug IDs: CSCvp36425

A vulnerability in the cryptographic driver for Cisco Adaptive Security Appliance Software (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reboot unexpectedly. The vulnerability is due to incomplete input validation of a Secure Sockets Layer (SSL) or Transport Layer Security (TLS) ingress packet header. An attacker could exploit this vulnerability by sending a crafted TLS/SSL packet to an interface on the targeted device. An exploit could allow the attacker to cause the device to reload, which will result in a denial of service (DoS) condition. Note:  Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability affects systems configured in routed and transparent firewall mode and in single or multiple context mode. This vulnerability can be triggered by IPv4 and IPv6 traffic. A valid SSL or TLS session is required to exploit this vulnerability. Cisco has rel

Site-to-site IPsec VPN with two FortiGates

In this example, you will allow transparent communication between two networks that are located behind different FortiGates at different offices using route-based IPsec VPN. The VPN will be created on both FortiGates by using the VPN Wizard's   Site to Site - FortiGate   template. In this example, one office will be referred to as HQ and the other will be referred to as Branch. 1. Configuring the HQ IPsec VPN On the HQ FortiGate, go to  VPN > IPsec Wizard . Select the  Site to Site  template, and select  FortiGate . In the  Authentication  step, set  IP Address  to the IP of the Branch FortiGate (in the example,  172.20.120.135 ). After you enter the gateway, an available interface will be assigned as the  Outgoing Interface . If you wish to use a different interface, select it from the drop-down menu. Set a secure  Pre-shared Key . In the  Policy & Routing  step, set the  Local Interface . The  Local Subnets  will be added automatically. Set  Remote