Screenshot published with the Fort Smith Southwest Times Record's reporting showing folders Interlock claims are connected to Fort Smith systems. The City has not publicly confirmed the authenticity or specific contents of the material. Image via Fort Smith Southwest Times Record / AOL.
Hey Fort Smith — there's a meaningful new layer to the City's cyberattack story, and this one needs to be explained carefully because the headline can get ahead of the evidence really fast.
An Arkansas cybersecurity professor says the publicly available evidence strongly supports Interlock's claim that the ransomware group has access to data taken from Fort Smith systems.
Dr. Lucas Moody, program director for cybersecurity and information technology in Arkansas Tech University's Department of Engineering and Computing Sciences, reviewed the information publicly available about the claim.
That includes Interlock publicly naming Fort Smith, describing the amount and types of data it says it possesses and posting screenshots that allegedly show portions of that information.
Moody told the Fort Smith Southwest Times Record that, taken together, the available evidence strongly supports Interlock's claims.
But stop right there before that turns into “Fort Smith confirmed everything Interlock said.”
It didn't.
The City has not confirmed that Interlock stole 5.7 terabytes of information.
The City has not confirmed that more than 100,000 Social Security numbers were exposed.
And Fort Smith has not publicly identified Interlock as the threat actor responsible for the original intrusion.
So what actually changed?
Until now, there were basically two separate pieces of this story.
First, Fort Smith itself confirmed that an unauthorized threat actor accessed municipal systems through the Fort Smith Police Department and exfiltrated data.
City Administrator Jeff Dingman said investigators determined how the attacker gained access and identified the scope of the information accessed.
The City also said the active threat had been contained and that officials were reviewing the information involved along with legal notification requirements to determine what residents or other affected people need to be told.
What Fort Smith has still not publicly disclosed is exactly what information left its systems.
Second, Interlock separately appeared on the scene claiming responsibility and saying it possessed a massive collection of City information.
Now there's an outside cybersecurity expert looking at what Interlock has publicly shown and saying the possession claim appears credible.
That's the new development.
Moody pointed to the specificity of the claim and the group's behavior in previous incidents.
Instead of simply posting “we hacked Fort Smith,” Interlock has described a claimed data volume, listed categories of information and posted screenshots.
That kind of behavior is consistent with how ransomware groups use stolen information as leverage.
There's also an important catch.
Even if Interlock really has Fort Smith data, that does not automatically prove Interlock performed every step of the original attack.
Cybercriminal groups can work together, sell access to compromised networks or exchange stolen information.
So possession of the data and responsibility for initially breaking into the City's systems are two different questions.
Moody said outside experts cannot definitively connect all of those pieces without access to the forensic evidence held by the City and its investigators.
Here's what Interlock says it has.
The group claims it obtained approximately 5,720 gigabytes of data — roughly 5.7 terabytes.
Interlock says that collection contains nearly 4.9 million files spread across more than 326,000 folders.
The group alleges the material includes police reports and images, mobile-device information, 911 call and incident records, records involving Fort Smith's water system and more than 100,000 Social Security numbers.
Those specific claims remain unverified.
That's worth repeating because it's probably the most important sentence in this story.
Fort Smith has confirmed that data was taken.
It has not confirmed the 100,000-Social-Security-number claim.
It hasn't confirmed the 5.7-terabyte number.
And it hasn't confirmed every category of information Interlock says appears in the collection.
Interlock itself, however, is a real and documented ransomware operation.
The FBI, Cybersecurity and Infrastructure Security Agency, Department of Health and Human Services and Multi-State Information Sharing and Analysis Center previously issued a joint cybersecurity advisory specifically about Interlock ransomware.
Federal investigators describe the operation as financially motivated and say Interlock uses a double-extortion model: steal data, encrypt systems and then threaten to publish the stolen information to pressure victims.
The FBI has observed Interlock activity against organizations in North America and Europe.
That doesn't establish that Interlock carried out Fort Smith's intrusion.
It does establish that the name appearing in this case belongs to a known ransomware operation rather than some random anonymous account making a claim online.
So what should regular residents actually do?
Nobody needs to panic because a ransomware group posted a giant number on a dark-web page.
But with the City confirming data theft and an outside cybersecurity expert now saying Interlock's possession claim appears well-supported, taking basic identity-protection steps is completely reasonable.
If you want the strongest simple protection against somebody opening new credit in your name, you can place a credit freeze with Equifax, Experian and TransUnion.
The Federal Trade Commission says credit freezes are free to place and lift, do not affect your credit score and are available to anybody at any time.
You don't have to wait for the City to confirm that your Social Security number appeared in a breach.
A freeze makes it harder for somebody to open a new credit account using your identity.
Just understand that a credit freeze doesn't protect an account that already exists.
You should still watch bank accounts, credit cards and security notifications for activity you don't recognize.
And expect scammers to use the Fort Smith cyberattack itself as bait.
A real data-breach story gives a scammer a believable opening.
“Your Fort Smith account was affected.”
“Click here to secure your information.”
“Verify your water account.”
“Confirm your Social Security number.”
Don't use the link they send you.
If somebody claims to be contacting you because of the City breach, go directly to the legitimate City, police department, bank or credit bureau yourself.
Hey Fort Smith — here's where this actually stands now.
Fort Smith has confirmed somebody broke into City systems and took data.
Interlock claims it has roughly 5.7 terabytes of City information and says some of it includes extremely sensitive personal records.
The City has NOT verified those specific Interlock claims.
But an Arkansas cybersecurity expert now says the public evidence strongly supports the idea that Interlock really does have access to Fort Smith data.
That's an important step forward in the story.
It still doesn't answer the question everybody actually cares about:
Whose information is in there?
The City says it is reviewing affected information and notification requirements.
Until those individual notices start going out, the smart approach is somewhere between panic and pretending nothing happened.
Watch your accounts.
Be suspicious of breach-related texts and emails.
And if you'd rather lock down new-credit fraud now instead of waiting to find out whether your Social Security number is involved, a credit freeze is free.
Community takeaway: Fort Smith has confirmed that an unauthorized attacker accessed City systems through the Police Department and removed data. Interlock claims it possesses approximately 5.7 terabytes of information from the City, and an Arkansas cybersecurity expert says the publicly available evidence strongly supports the group's possession claim. The City still has not confirmed Interlock's identity, the claimed data volume, the alleged 100,000-plus Social Security numbers or the other specific categories listed by the group.
Fort Smith Community Hub
Keeping our community connected, one story at a time.
📍 Fort Smith, Arkansas · 479 · iam479.com.
Sources: Fort Smith Southwest Times Record — cybersecurity expert assessment of Interlock's Fort Smith data claim · Talk Business & Politics — Interlock claim and City response · FBI, CISA, HHS and MS-ISAC — joint Interlock ransomware advisory · Federal Trade Commission — credit freezes and fraud alerts
Comments
Post a Comment