{ "id": "ca86e4bc-598f-47aa-81d9-813f5f031218", "created_at": "2026-04-06T00:15:18.340729Z", "updated_at": "2026-04-10T03:21:18.689891Z", "deleted_at": null, "sha1_hash": "fb0726d42dedcf9c6dba12d385879aa3d9b6c6e3", "title": "Maze Ransomware Behind Pensacola Cyberattack, $1M Ransom Demand", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 765088, "plain_text": "Maze Ransomware Behind Pensacola Cyberattack, $1M Ransom\r\nDemand\r\nBy Lawrence Abrams\r\nPublished: 2019-12-11 · Archived: 2026-04-05 20:01:50 UTC\r\nThe operators behind the Maze Ransomware have claimed responsibility for the cyberattack affecting the City of Pensacola,\r\nFlorida, but state that they are not affiliated with the recent shooting at NAS Pensacola.\r\nIn an email conversation with BleepingComputer, the operators of the Maze Ransomware stated that they were responsible\r\nfor encrypting the city's data and have demanded a $1,000,000 ransom for a decryptor.\r\nWhen Maze targets a network, they will steal the victim's files before they are encrypted. The attackers then tell the victim\r\nthat they will publicly release these files unless the ransom is paid.\r\nhttps://www.bleepingcomputer.com/news/security/maze-ransomware-behind-pensacola-cyberattack-1m-ransom-demand/\r\nPage 1 of 4\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/maze-ransomware-behind-pensacola-cyberattack-1m-ransom-demand/\r\nPage 2 of 4\n\nVisit Advertiser websiteGO TO PAGE\r\nMaze is not the first ransomware to make these claims, but as we have seen with the release of Allied Universal's\r\ndocuments, the Maze crew appears to be willing to follow up with their threats.\r\nMaze has shared documents that were allegedly stolen from the city, but did not state if they have given a deadline to\r\nPensacola or will release them.\r\nOne item that appeared to be of concern to the Maze operators was the timing of their attack.\r\nWithout our prompting, the Maze Ransomware operators expressed concerns about being linked to the recent NAS\r\nPensacola shooting and told BleepingComputer that they had nothing to do with it.\r\n\"We also must tell you that there is no any connections with the shooting event that occurred before running maze. We did\r\nnot know about this. It is just coincidence.\"\r\nMaze states they avoid emergency services\r\nMaze also wanted to reassure us that they purposely avoided emergency services, or what they call 'socially significant\r\nservices', such as 911.\r\n\"Also we want to emphasize that no one of the socially significant services has suffered (for example 911).\"\r\nWhen we asked if they purposely avoided services like these, they told us that medical care centers or other 'socially vital\r\nobjects' are not allowed and will decrypt any that are encrypted for free.\r\n\"We don’t attack hospitals, cancer centers, maternity hospitals and other socially vital objects, up to the point that if\r\nsomeone uses our software to block the latter, we will provide a decrypt for free.\"\r\nCity Recovering\r\nWhen we attempted to confirm if the information provided by Maze is accurate, Kaycee Lagarde, Public Information Officer\r\nfor the City of Pensacola, told BleepingComputer that due to ongoing investigations they could not provide additional\r\ndetails.\r\nLagarde did tell us that the city is slowly recovering and that their mail servers are back up and that most landlines have\r\nbeen restored. Employees, though, continue to be unable to access their computers or the Internet until all of the issues are\r\nresolved.\r\nWe are currently in an assessment and recovery mode, and our IT Department is continuing to work diligently to make sure\r\nall computers are free of any viruses before we reconnect them to the network. We don’t have an estimated time of\r\ncompletion, but they are working to restore services as quickly as possible. As IT works to restore services, they are also\r\nlooking into bringing experts in to assist with evaluating any potential impacts to data.\r\nOur email servers are back up, but since IT still has our computers disconnected from the network, city employees only have\r\nlimited access to email (via smartphone for employees who have city cell phones).\r\nMost landlines have been restored.\r\nThe city remains operational, but we are somewhat limited since we aren’t able to use our computers or internet until these\r\nissues are resolved. Emergency dispatch and 911 services were not impacted and continue to operate. Our website at\r\ncityofpensacola.com and online permitting services at mygovernmentonline.org were not impacted and remain operational.\r\nhttps://www.bleepingcomputer.com/news/security/maze-ransomware-behind-pensacola-cyberattack-1m-ransom-demand/\r\nPage 3 of 4\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/maze-ransomware-behind-pensacola-cyberattack-1m-ransom-demand/\r\nhttps://www.bleepingcomputer.com/news/security/maze-ransomware-behind-pensacola-cyberattack-1m-ransom-demand/\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "references": [ "https://www.bleepingcomputer.com/news/security/maze-ransomware-behind-pensacola-cyberattack-1m-ransom-demand/" ], "report_names": [ "maze-ransomware-behind-pensacola-cyberattack-1m-ransom-demand" ], "threat_actors": [], "ts_created_at": 1775434518, "ts_updated_at": 1775791278, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/fb0726d42dedcf9c6dba12d385879aa3d9b6c6e3.pdf", "text": "https://archive.orkl.eu/fb0726d42dedcf9c6dba12d385879aa3d9b6c6e3.txt", "img": "https://archive.orkl.eu/fb0726d42dedcf9c6dba12d385879aa3d9b6c6e3.jpg" } }