The insurance company who work on behalf of the Montclair Township’s IT department say that they had reached a settlement figure of USD$450,000 with those responsible for launching a cyber attack in early June 2023
YouTube announcement
The Mayor of Montclair, which is a township in New Jersey took to YouTube on June 6th to announce the cyber attack to residents.
Montclair has a population of approx. 41,000 people and is home to the states 2nd largest University – Montclair State University.
The attack took place on the same day that the township held its municipal election, but the mayor assured people that the attack had not affected the voting system, and urged people to still go to the polls to cast their votes.
Settlement – not ransom
The settlement figure was negotiated while law enforcement agencies began investigating potential criminal charges related to the attack.
Working in conjunction with the townships insurance company, state, and federal authorities, the situation was partially resolved, with critical data essential for township business and operations being recovered.
Data belonging to individual users and external vendors providing storage for past records is still in the process of being recovered
Legality of paying a ransom
Whether to pay a ransom demand or not is a subject of debate in many countries. In the USA, The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) prohibits making payments to individuals or entities on its sanctions list.
The FBI does not support paying a ransom in response to a ransomware attack and state that “Paying a ransom doesn’t guarantee you or your organization will get any data back. It also encourages perpetrators to target more victims and offers an incentive for others to get involved in this type of illegal activity.”
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also advises against paying ransoms to discourage further attacks
However, all these provisions leave some space for negotiation, so in other words, there is no absolute ban on ransom payments – or “Settlements” as the case may be…