{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2019-riviera-beach-pays-600-000-ransom-after-an-employee-clicked-a-malicious"},"incident":{"slug":"2019-riviera-beach-pays-600-000-ransom-after-an-employee-clicked-a-malicious","title":"Riviera Beach pays $600,000 ransom after an employee clicked a malicious email link","date":"2019-05-29","date_precision":"day","year":2019,"victim_org":"City of Riviera Beach, Florida","sector":"Government","country":"United States","primary_vector":"Spear Phishing (Email)","secondary_vectors":[],"ai_involvement":"No AI reported","ai_notes":"","outcomes":["Ransomware Deployment","Service Disruption","Extortion"],"loss_usd":600000,"loss_kind":"ransom_paid","loss_note":"65 bitcoin, about US$600,000 at the time, authorised by the city council and paid largely through the city's insurance. The city separately approved about US$1 million for replacement hardware.","records_affected":null,"threat_actor":null,"summary":"The city of Riviera Beach, Florida was hit by ransomware in late May 2019 after a city employee clicked a malicious link in an email. The attack disabled city email, payroll systems and parts of the 911 dispatch infrastructure, forcing staff onto paper processes. In June 2019 the city council voted to pay 65 bitcoin, roughly $600,000, to obtain a decryption key, in addition to about $1 million already approved for new hardware.","how_it_worked":"A single employee in the city's administration opened an email and clicked the link inside it, which delivered the payload that encrypted municipal systems. Nothing about the delivery was exotic; the significance is what a small municipality's environment allowed to follow. Flat networks, shared administrative credentials and backups reachable from the same domain meant one workstation compromise propagated to payroll, email, utility billing and dispatch support systems. With no clean restore path and public safety services degraded, the council concluded that paying the ransom was faster than rebuilding, making Riviera Beach the template case for municipal ransom payment.","lessons":"Offline, immutable backups tested for restoration change the entire calculus, because the decision to pay was driven by recovery capability rather than by the initial click.","confidence":"Confirmed","sources":[{"title":"Florida city to pay $600K ransom to hacker who seized computer systems weeks ago","url":"https://www.cnn.com/2019/06/20/us/riviera-beach-to-pay-hacker/index.html","publisher":"CNN"},{"title":"Florida city pays hackers $600,000 after ransomware attack","url":"https://statescoop.com/florida-city-pays-hackers-600000-after-ransomware-attack/","publisher":"StateScoop"}],"entry_type":"incident","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2019-riviera-beach-pays-600-000-ransom-after-an-employee-clicked-a-malicious"}}