Wichita, Kansas Cyberattack of May 2024

Editor: Ava Gozo. 

The Wichita, Kansas Cyberattack of 2024 was a significant ransomware attack that had widespread impacts on the city's operations and services. Here are the key details:

Incident Overview

Date of Attack: The cyberattack occurred between May 3 and 4, 2024, and was publicly announced on May 5, 2024[1][2].
 

Type of Attack: The attack involved ransomware, specifically attributed to the LockBit ransomware gang[2][6].
 

Immediate Response: The city shut down its computer network to prevent the spread of the malware, which led to the temporary unavailability of several city services[1].

Impact on City Services

Service Disruptions: Many city services were disrupted, including payment portals for water and sewer bills, the clerk's office, and the municipal court system[1]. The attack also affected the WiFi and departure screens at the local airport, and forced city-run organizations to revert to cash payments for various services[6].
Law Enforcement and Emergency Services: Wichita's police and fire departments had to switch to backup procedures and use paper for creating reports[1][6].
Communication Issues: Many city departments could not be contacted by phone, although some divisions like the city manager's office and IT still had working phones[1].

Data Compromise

Personal Information: The attack compromised personal information, including names, Social Security numbers, driver’s licenses, state IDs, and payment card information[2][5]. Law enforcement data, including incident and traffic information, was also affected[5][15].
Extent of Data Breach: The city confirmed that files were copied from its network without permission, but did not disclose the full extent of the data breach or how far back the files dated[5].

Response and Investigation

Law Enforcement Involvement: Federal and local law enforcement agencies were notified and are investigating the incident[1][2].
Mitigation Efforts: The city's IT department is working with third-party specialists to restore the compromised network and put mitigation measures in place[1][5].
Public Communication: The city has been providing updates through FAQs and news releases, although some information is being withheld for operational security purposes[1][18].

Broader Context

Healthcare Impact: The attack on Wichita was part of a broader trend of ransomware attacks affecting various sectors, including healthcare. For instance, Ascension hospitals in Wichita also experienced a cyberattack around the same time, disrupting clinical operations and patient care[4].
Cybersecurity Measures: The incident underscores the importance of robust cybersecurity measures and the need for continuous improvement in incident response and resilience strategies, as highlighted in events like the Kansas Public Sector Cybersecurity Summit[3][9].

In summary, the Wichita cyberbreach of 2024 was a ransomware attack that caused significant disruptions to city services, compromised personal and law enforcement data, and required extensive response efforts from local and federal authorities.

Citations:
[1] https://www.govtech.com/security/ransomware-attack-on-wichita-gov-causes-city-network-outage
[2] https://www.scmagazine.com/brief/ransomware-attack-impacts-law-enforcement-data-in-wichita
[3] https://events.govtech.com/Kansas-Public-Sector-Cybersecurity-Summit
[4] https://www.kake.com/story/50762870/cyberattack-disrupts-operations-at-major-us-healthcare-network
[5] https://www.ksn.com/news/local/wichita-cyberattack-got-personal-financial-information/
[6] https://therecord.media/wichita-kansas-ransomware-attack-claimed-by-lockbit
[7] https://statescoop.com/cyberattack-macon-bibb-county-georgia-2024/
[8] https://thebeaconnews.org/stories/2024/01/25/how-ransomware-attacks-at-kansas-city-hospitals-threaten-your-privacy/
[9] https://www.ebit.ks.gov/divisions/information-security-office-kiso/cyber-summit
[10] https://www.ksn.com/news/state-regional/kansas-courts-cyber-attack-impacts-150000-people/
[11] https://www.ksn.com/news/local/wichita-cyberattack-update-what-residents-need-to-know/
[12] https://www.kwch.com/2024/05/11/cyber-attacks-leave-significant-financial-impact-hacked-organizations/
[13] https://www.kwch.com/2024/05/14/city-wichita-says-social-security-numbers-other-ids-compromised-security-breach/
[14] https://www.kwch.com/video/2024/05/07/city-wichita-feels-impact-cyber-security-attack/
[15] https://www.kansas.com/news/politics-government/article288491333.html
[16] https://seculore.com/state/kansas/05-06-2024-ks-city-of-wichita/
[17] https://www.kansas.com/news/politics-government/article288397380.html
[18] https://www.kansas.com/news/politics-government/article288549047.html
[19] https://www.kwch.com/2024/01/23/delays-background-checks-continue-kansas-court-system-recovers-cyberattack/
[20] https://www.kwch.com/2024/05/14/city-wichita-says-cyberattack-did-not-hurt-water-systems-other-faqs/