Officials: Virginia IT agency hit with ransomware attack
The information technology agency that serves Virginia’s legislature has been hit by a ransomware attack that has substantially affected its operations
Your support helps us to tell the story
From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.
At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.
The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.
Your support makes all the difference.The information technology agency that serves Virginia s legislature has been hit by a ransomware attack that has substantially affected its operations, state officials said Monday.
Gov. Ralph Northam s spokeswoman, Alena Yarmosky, confirmed the attack on Virginia's Division of Legislative Automated Systems. In a brief statement provided to The Associated Press, Yarmosky said the governor had been briefed on the matter and directed executive branch agencies to offer help in “assessing and responding to this ongoing situation.”
The Division of Legislative Automated Systems, or DLAS, is the General Assembly's IT agency. The timing of the attack is particularly problematic, as lawmakers and staff are deep into preparations for a legislative session set to start in January.
The attack marks the latest in a ransomware scourge that has exploded over the past year, with attacks against governments, critical infrastructure and major corporations.
Cybersecurity researchers who track ransomware say there’s no previous record of a state legislature suffering an attack.
“It continues to show that no organization is safe form these ransomware attacks. Anybody anywhere can be hit,” said Allan Liska, an intelligence analyst at the cybersecurity firm Recorded Future.
A top agency official told Virginia legislative leaders in an email obtained by The Associated Press that hackers using “extremely sophisticated malware” had accessed the system late Friday.
A ransom note with no specific amount or date was sent, according to the email sent Monday afternoon by Dave Burhop.
The agency was working with authorities to determine “the scope of the issue and plan for possible remediation,” Burhop wrote. All of the agency's internal servers, including those for bill drafting, the budget system and the General Assembly voicemail system, were affected, the email said.
“We can’t get much done,” Senate Clerk Susan Clarke Schaar told the Richmond Times-Dispatch.
Burhop's email said his agency was collaborating with law enforcement agencies including the FBI An FBI spokesman declined comment.
The email also said cybersecurity firm Mandiant had been retained since a “breach” over the summer involving the use of an employee's credentials and was assisting in the investigation. A company spokesperson declined comment.
“After upcoming meetings, we will provide additional information, including a course of action to this leadership group but please understand this likely will not be resolved quickly,” wrote Burhop, who couldn’t immediately be reached for further comment.
Brett Callow, a threat analyst at the firm Emsisoft, said Virginia is the 74th state or local government hit by ransomware attacks this year, though the first legislature he’s ever seen attacked.
“Honestly, I’m surprised it hasn’t happened before,” Callow said.
Liska said it’s not uncommon for ransomware gangs to try to time their attacks to inflict maximum pain on the targets, like some hackers have done to school districts just at the start of a school year.
“They are smart enough to do that,” he said.
The website for the Division of Capitol Police was also down as a result of the attack. But a spokesperson said the agency was operational, with its critical communications functions unaffected.
Although DLAS does not fall within the purview of the Virginia Information Technologies Agency, which oversees IT for the state’s executive branch, a VITA spokesperson said the agency was also helping with the response effort.