{
	"id": "c3efd836-cfac-49b5-b9dc-da3259778a70",
	"created_at": "2026-04-06T00:08:42.528904Z",
	"updated_at": "2026-04-10T03:19:56.534203Z",
	"deleted_at": null,
	"sha1_hash": "ee487a0d88c73e3399beed485efcbde8ce126f4b",
	"title": "Ryuk Ransomware Campaign Targets Port Lavaca City Hall",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 96234,
	"plain_text": "Ryuk Ransomware Campaign Targets Port Lavaca City Hall\r\nBy CISOMAG\r\nPublished: 2020-02-18 · Archived: 2026-04-05 17:28:08 UTC\r\nThe Port Lavaca City Hall’s server was recently hit by Ryuk ransomware that apparently entered through the\r\nemail system. The ransomware took down the local government’s server, the city’s billing and auto-pay systems,\r\nand disrupted other regular operations. However, water, sewer, and the police department’s systems remained\r\nunaffected in the incident.\r\nAccording to the City’s Mayor Jack Whitlow, no information was stolen or compromised but the attackers\r\nencrypted the files to demand a ransom. The city officials are working on restoring their systems to get back into\r\nworking order. It’s said that the attack already incurred a bill amounting to nearly US$50,000  to the City. Whitlow\r\nstated that hackers demanded US$200,000 ransom to decrypt the data.\r\nThe City officials reported the issue to the FBI for further investigation and confirmed that they’re not fulfilling\r\nany ransom demands. Whitlow said, “I’d rather pay the people in town to fix it and keep the money in the\r\ncommunity. We’re going to be down for a little while. It may take a while to get completely up to date. We are\r\ngetting most of our system up and running, but we are recovering some of that data right now.”\r\nThe Port Lavaca City Hall’s Manager William DiLibero stated, “The attack brought down our billing system. Our\r\nonline and auto payment systems are out of service and we have gone back to our older collection and payment\r\nhttps://www.cisomag.com/ryuk-ransomware-campaign-targets-port-lavaca-city-hall/\r\nPage 1 of 2\n\nprocesses. Staff are collecting cash, check and credit card payments at City Hall. We will need to rebuild our\r\ndatabase in order to get the payment system back to full operational status. The City has worked with State and\r\nFederal agencies to address this attack.”\r\nRyuk in the News\r\nRecently, the officials of the U.S. Coast Guard (USCG) disclosed a Ryuk ransomware infection that took down the\r\nentire corporate IT network of a Maritime Transportation Security Act (MTSA) regulated facility for more than 30\r\nhours. According to the USCG officials, the ransomware interrupted the camera and physical access control\r\nsystems. It’s believed that a malicious email sent to one of the maritime facility’s employees was the entry point\r\nfor the ransomware infection.\r\nThe ransomware corrupted the enterprise IT network files, encrypted them, and prevented the facility’s access to\r\ncritical files. The officials stated that the incident affected the facility’s IT network and industrial control systems\r\nthat monitor and control cargo transfer operations.\r\nSource: https://www.cisomag.com/ryuk-ransomware-campaign-targets-port-lavaca-city-hall/\r\nhttps://www.cisomag.com/ryuk-ransomware-campaign-targets-port-lavaca-city-hall/\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://www.cisomag.com/ryuk-ransomware-campaign-targets-port-lavaca-city-hall/"
	],
	"report_names": [
		"ryuk-ransomware-campaign-targets-port-lavaca-city-hall"
	],
	"threat_actors": [],
	"ts_created_at": 1775434122,
	"ts_updated_at": 1775791196,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/ee487a0d88c73e3399beed485efcbde8ce126f4b.pdf",
		"text": "https://archive.orkl.eu/ee487a0d88c73e3399beed485efcbde8ce126f4b.txt",
		"img": "https://archive.orkl.eu/ee487a0d88c73e3399beed485efcbde8ce126f4b.jpg"
	}
}