Hackers are reportedly “redoubling their efforts to penetrate the county’s systems” after Mecklenburg County officials decided not to pay a ransom to unfreeze hacked servers, officials said Thursday.
Mecklenburg County remains open for business as it continues to restore services.
According to county officials, cybercriminals are trying to use emails with fraudulent attachments and viruses to further damage the county’s systems. County officials are asking residents and employees to remain patient.
County Manager Dena Diorio says hackers froze 48 county servers, and asked for two bitcoins in ransom, which totals about $23,000. This, despite claims made by other county officials to WBTV that the hackers were actually seeking a ransom on each server, which would have run the ransom into a range of the hundreds of dollars.
On Thursday, officials said ITS is disabling county employees’ option to open attachments in Drop Box and Google Documents. Officials released this statement:
“The best advice for now is to limit your use of emails containing attachments, and try to conduct as much business as possible by phone or in person. “
As the county manager refuses to pay the hackers, the county’s IT team begins work on repairing the 48 frozen servers, and bringing the affected county departments back to normal working order. These departments include the tax office, register of deeds, LUESA, assessor’s office, park and recreation, department of social services, child support enforcement, finance, sheriff’s office, and the courts.
The county was experiencing a county-wide computer system outage Tuesday afternoon. Just after 6 p.m., officials told reporters that the servers were being held for ransom.
Officials have not given a timeline for how long the repairs will take, but say they will take “days.” They have prioritized repairs on servers affecting health and human services, the courts, and LUESA.
Diorio told WBTV that bringing the 48 servers back to full strength is a process that could go into early 2018.
“Now understand things will come back up incrementally, so as we bring systems on line we won’t be shot down that long, but by the time we get everything fully restored I would say the first of the year,”Diorio said.
Rather than pay hackers demands to get rid of ransomware, the county is taking matters into its own hands.
One place impacted and where business practices have changed is the Mecklenburg County Tax Office.
Online payments have become the norm, but with computers being down fees collected in person.
Daniel Chisholm ended up with handwritten receipt and a dose of reality.
“I am paranoid about using the internet and I use it all the time. Problem is that’s the wave of the future and you can’t get around it,” Chisholm said.
Theresa Payton and her company Fortalice Solutions is one of the companies hired by Mecklenburg County to work through this series of challenges.
She is also a WBTV cyber security expert who says hackers in most instances are hoping to beat the odds.
“For cyber criminals they have nothing to lose and everything to gain. If you think about, you have to get it right 365 days out of the year, and they only have to get it right once,” Payton said.
Getting right during this period of recovery is the goal of the county manager.
“We just ask people to work with us and be patient to the best of their ability,” Diorio said.
Dioro also expects work to continue through the weekend and through the holidays.
In the meantime, they have asked customers to call these departments to check on their services.
Below is information from county officials given Thursday of offices affected during the server outage, along with direction for customers moving forward.
Assessor’s Office (CAO)
- County Assessor’s Office reports AssessPro (The Real Property appraisal system), NCPTS (the personal property appraisal system and the billing and collection system) are down.
- Polaris and Tax Bill look up county web links are not working.
Criminal Justice Services
- Research & Planning cannot run the daily population numbers without OMS interfacing with our data warehouse. (Please note that we anticipate a spike in the jail numbers due to the release process being slowed.)
Child Support Enforcement (CSE): CSE is in full Manual Services- still seeing customers here and in the Courthouses, all records are being hand-written and the Clerk’s office is printing/making copies for the Court.
- Advantage is Down
- ACTS- Automated Collection and Tracking System is down- which is used to interface with other state and federal systems; document generation; pay histories; charging and billing functions, etc
- Compass/OnBase is down
- Dept. Of Vital Records is down
- Qflow- Used to track customer visits by date, time, visit purpose, service provider, etc.
Community Support Services: The Domestic Violence Victim Services phone line (704-336-3210) is now fully functioning.
- ECHO for Substance Use Services (they are documenting on paper & will scan into the system once operational),
- OnBase for Veterans Services & secure printing and copying. We are seeing clients but Veterans Services may run slower. As soon as we have access to a copier we will run much smoother.
- All secure printing & coping DOWN.
- Community Support Services Prevention & Intervention Division is unable to transfer a call from the receptionist to a clinician.
Department of Social Services (DSS): All DSS services and programs are up and running with the exception of individual medical transportation scheduling.
- All Public Assistance programs and services are available. We have made adjustments to work around the systems that are unavailable.
- Adult Protective Services and Child Protective Services are fully operational.
If you have made a transportation reservation through DSS/MTS scheduling, please call Customer Connection at 704-336-4547 to confirm your transportation. This includes reservations made for bus passes and vendor transportation for trips scheduled through December 11, 2017.
- Services/support are all manual and limited as most all of our work relies on Advantage as our core financial system.
- Automated payments, invoicing, procurement, etc. This means no Electronic funds transfers, processing of procurement requests in the system, or other similar transactions. Because many of our internal controls are automated, or rely on systems (verifying funds, etc.), most of our services will be manual and slowed, but we should be able to perform them. We also cannot apply payments received to the balance owed in the system—meaning we will have a backlog and some risk to the extent collections are continuing.
- Applicants cannot apply for vacant positions
- No changes since last communication
The LUESA offices on Suttle Ave continue to operate to provide services to our building community. If you have urgent permitting and inspection needs, please call 980-314- CODE (2633) and staff will be able to coordinate your request for service.
- Code and Storm Water Services cannot review plans or issue new permits until POSSE/Winchester and other supporting systems including GIS, Navision (payment processing) are up.
- GIS cannot provide addressing and other services including processing register of Deeds data until the GIS servers are back online.
- Air Quality services for asbestos reviews etc cannot be performed until the permitting system is up.
MEDIC: Nothing affected at this time.
Office of the Tax Collector
- Property tax payments cannot be made at the Wilkinson Boulevard location.
- Tax records and payment information cannot be accessed online or by telephone.
- Research requests for bankruptcy, tax certificates, tax lien research, or any other service requiring reference to the tax records cannot be performed.
- All online services including online payment options are not available.
As of Wednesday night, the county’s domestic violence hotline was down. They were directing callers to Safe Alliance reached at 704-332-2513.
County officials say employees’ payroll will not be affected by the Dec. 15 pay date. Officials say most printers are still offline, with a limited number enabled in specific offices.