[null, null, null, {"document_url": "https://www.usatoday.com/story/news/2017/12/06/hackers-shut-down-mecklenburg-county-servers-demand-23-k-ransom/926779001/", "unformatted_src": "https://www.gannett-cdn.com/media/2017/12/06/USATODAY/USATODAY/636481649023462902-120617-NC-Mecklenburg-County-Charlotte-Online.png", "src": "https://www.gannett-cdn.com/media/2017/12/06/USATODAY/USATODAY/636481649023462902-120617-NC-Mecklenburg-County-Charlotte-Online.png", "formatted_filename": "NC Mecklenburg County Charlotte Online"}, null]
N.C. county weighs paying cyber hackers $26K ransom for servers held hostage

Official business in the county serving Charlotte frozen by widespread outage.






Doug Stanglin, USA TODAY Published 11:29 a.m. ET Dec. 6, 2017 | Updated 3:34 p.m. ET Dec. 6, 2017 Laptops used in cybercrime are largely untraceable and can operate anywhere worldwide.(Photo: MariuszBlach, Getty Images/iStoc)


Officials in North Carolina's Mecklenburg County wereÂ in touch with hackers, believed to be from Iran or Ukraine, and plannedÂ toÂ decide Wednesday evening whether to pay them $26,000 to win the release of multiple files held hostage on county servers.

County manager Dena Diorio told reporters it could takeÂ "days not hours" to restore the computers and bring full service back, regardless of whether the county pays the ransom.

Cyber experts believeÂ theÂ hackers operated from Iran or Ukraine and infectedÂ theÂ serversÂ with a new strain of ransomware known as LockCrypt, she said.

An email attachment opened byÂ a county employee Tuesday initiated the attack. The attachment contained a "worm" that began encrypting the county's files. It also contained an email address and instructions on how to pay the ransom.

The ransomware was quickly spotted and isolated, but still affectedÂ 48 of the county's 500 servers,Â Diorio said.Â The county was "open for business" but many operations had slowed, she added. Because of a backup system, the hack didn't compromise any personal information or delete anyÂ data.

Diorio said all servers were operating, but information on scheduled medical tripsÂ by some 300 patients were lost and aÂ domestic violence hotline was sending calls directly to voicemail.

The hackers originally gave officials until 1 p.m. Wednesday to pay twoÂ BitcoinÂ in exchange for an encryption key that would release the files.Â Â

The county faced the dilemma of paying the ransomÂ orÂ reconstructing the system using the backup data.

"IfÂ we don't pay, we will have to rebuild applications from scratch and that will take even longer," DiorioÂ said.

The officials also weighed whether anyÂ encryption key would actually work to unlock the servers and whether they would then be completely free of the ransomware.

Although the deadline passed without a payment, the hackers apparently were taking no action as long as county officialsÂ were in communicationÂ with them through cybersecurity experts.

During the day, however, the value of Bitcoins soared fromÂ $23,000 toÂ $26,000. Read or Share this story: https://usat.ly/2AeaqHk