A screenshot of the Interlock ransomware group's claimed Fort Smith posting. The group's claims about the contents of the files have not yet been verified by the City. Image via Talk Business & Politics.
Hey Fort Smith — this is the most important new development in the City cyberattack story since officials confirmed Tuesday night that data was taken.
Fort Smith is now publicly acknowledging the dark-web posting tied to the attack and says investigators are actively collecting the posted files so they can determine whether they actually came from City and Police Department networks — and whether they contain protected personal information.
That distinction matters.
Tuesday night, the City confirmed that an unauthorized attacker gained access to municipal systems through the Fort Smith Police Department and exfiltrated certain data.
Fort Smith also said investigators had identified how the attacker entered the system, determined the scope of the information accessed and received assurance that the active threat had been contained.
What the City had not publicly addressed was the material that appeared online afterward.
That changed Wednesday.
In a statement provided to Talk Business & Politics, Fort Smith acknowledged that it is aware of a dark-web posting purporting to contain information copied from City of Fort Smith and Fort Smith Police Department networks.
The City says investigators are now collecting that material for further review.
The City is not saying those dark-web files are authentic yet.
This is where everybody needs to be careful with what gets shared on Facebook and social media.
The ransomware group known as Interlock is claiming responsibility for the Fort Smith attack.
The group claims it obtained roughly 5.7 terabytes of City information.
Interlock is also making much more serious claims about what is supposedly contained in that data, including Social Security numbers, police records, 911 information and information connected to City water systems.
Those specific claims have not been verified by the City of Fort Smith.
Fort Smith has not publicly confirmed that Interlock was definitely the attacker.
It has not confirmed that 5.7 terabytes were taken.
It has not confirmed that more than 100,000 Social Security numbers were exposed.
And it has not confirmed that every category of data Interlock claims to possess is authentic.
The City's position Wednesday is basically this:
We know the posting exists. We're collecting the material. Now investigators have to determine what it actually is.
That's a much more accurate description than either extreme people may see online.
“Nothing happened” is no longer accurate because the City itself confirmed data was exfiltrated.
But “every Fort Smith resident's identity was stolen” has not been established either.
Reviewing this much information could take a while.
Fort Smith says collecting and analyzing the material will be a time- and resource-intensive process.
That makes sense if the amount involved is anywhere close to what the ransomware group claims.
Investigators don't simply look at a folder name and declare somebody's information exposed.
They have to determine whether individual files actually originated from Fort Smith systems, whether files are complete or altered, what information is contained inside them and which people may be affected.
Then comes the legal part.
Investigators and City officials have to determine which information qualifies as protected information and which individuals must receive notification.
Fort Smith says that if investigators determine information was copied from the City's network and contains protected information, notice will be provided in accordance with the City's obligations.
That notification piece matters.
Arkansas' Personal Information Protection Act requires organizations to notify affected people when protected personal information has been compromised under circumstances covered by the law.
The Arkansas Attorney General also recommends that people affected by a security breach consider fraud alerts, security freezes and monitoring their credit reports for unusual activity.
So should every Fort Smith resident freeze their credit tonight?
Not because the City has confirmed your Social Security number was stolen.
It hasn't.
But there's also nothing wrong with somebody deciding they'd rather lock down their credit now instead of waiting.
The Federal Trade Commission says a credit freeze is free to place and lift, doesn't affect your credit score and makes it much harder for an identity thief to open a new credit account in your name.
Anybody can place a freeze.
You do not have to wait until your Social Security number or other information is officially confirmed in a data breach.
To fully freeze your credit, you have to place the freeze with each of the three major credit bureaus — Equifax, Experian and TransUnion.
If you don't want to do that yet, at minimum start paying closer attention to unfamiliar accounts, strange password-reset messages, financial activity you don't recognize and unexpected emails or texts claiming to come from the City.
And be especially suspicious of anybody suddenly contacting you because of the “Fort Smith data breach.”
Scammers love real-world events because the story makes their fake message feel believable.
If somebody sends you a link and says you need to verify your identity, utility account, Social Security number or payment information because of the cyberattack, don't use their link.
Go directly to the legitimate organization yourself.
There is also an important piece of good news in Wednesday's City statement.
Fort Smith says the appearance of the material online has not impacted the security of the City's network or its ongoing recovery efforts.
The City previously said the active threat had been contained and all public-facing City services were online.
So seeing stolen information posted after an attack does not automatically mean hackers got back into the City network Wednesday.
Ransomware groups often steal data during an intrusion and publish it later as part of an extortion campaign.
What residents need answered now isn't simply whether City computers are working again.
It's what information left those computers before the attackers were removed.
And several major questions remain unanswered.
Fort Smith has not publicly confirmed that Interlock is the attacker.
It hasn't said whether a ransom was demanded.
It hasn't said whether the City or an insurance provider paid anything.
And investigators have not yet identified which residents, employees, businesses, vendors, police-case subjects or other people may have information contained in the stolen material.
Hey Fort Smith — here's where this story moved Wednesday.
Yesterday we knew Fort Smith data had been stolen.
Today we know material claiming to come from Fort Smith and Fort Smith Police networks has been posted on the dark web — and the City is actively collecting and reviewing it.
That still does not mean every claim Interlock makes is automatically true.
But it does mean this investigation has entered the stage residents actually care about most:
What was taken?
Is the leaked material authentic?
Whose information is inside it?
And who needs to start protecting themselves?
The City says people will be notified if investigators confirm that protected information belonging to them was compromised.
Until then, don't panic — but don't ignore this one either.
If you want maximum precaution now, a credit freeze is free and can be lifted whenever you need to apply for new credit.
And if some sketchy email or text shows up tomorrow telling you to “verify your identity because of the Fort Smith cyberattack,” do not click the link.
This story isn't finished.
The next truly important update will be when Fort Smith tells residents what investigators actually found inside the leaked files.
Community takeaway: Fort Smith now acknowledges a dark-web posting purporting to contain data copied from City and Police Department networks and says investigators are collecting and reviewing the material. The City has not yet verified Interlock's claims regarding the amount or specific contents of the data. Fort Smith says affected people will be notified if investigators determine protected personal information was compromised. The City also says the leak has not affected the security of its restored network or ongoing recovery efforts.
Fort Smith Community Hub
Keeping our community connected, one story at a time.
📍 Fort Smith, Arkansas · 479 · iam479.com.
Sources: Talk Business & Politics — Interlock claim and new City statement on dark-web data review · Talk Business & Politics — Fort Smith confirms data exfiltration and containment · Arkansas Attorney General — security and data-breach guidance · Federal Trade Commission — credit freezes and fraud alerts
Comments
Post a Comment