The city of Shenandoah, Texas yesterday notified 454 Texans of a data breach that compromised names, Social Security numbers, driver’s license numbers, passports, financial account numbers, credit and debit card numbers, medical info, health insurance info, and dates of birth.
The city hasn’t publicly disclosed when or how the breach occurred, but ransomware group LockBit claimed responsibility for an attack against Shenandoah in January.
In March 2024, city council meeting minutes (PDF) specifically mention a three-year, $100,000 contract to update the city’s backup system and get a $10 million ransomware recovery warranty.
The City has not confirmed LockBit’s claim. We do not yet know whether the city paid a ransom or how attackers breached Shenandoah’s network. Comparitech contacted the city council for comment and will update this article if it responds.
We recommend victims take advantage of any free credit monitoring and/or identity theft protection services offered by the city. Monitor your credit report, financial accounts, and medical bills for suspicious activity.
Who is LockBit?
LockBit is one of the most prolific ransomware gangs, first appearing in 2019. The group is most likely based in Russia.
LockBit often extorts victims twice: once for a decryption key to restore systems that its malware has encrypted, and again in exchange for not selling or publicly releasing stolen data.
Comparitech has logged 45 confirmed attacks claimed by LockBit so far in 2024, along with another 356 unconfirmed attacks. LockBit’s average ransom demand was about $4 million.
LockBit was also responsible for attacks on the Jacksonville Beach, FL; Fulton County, GA; and Wichita, KS.
Ransomware attacks on US government organizations
If confirmed, the attack on Shenandoah, TX will join 38 other attacks on US government entities, which compromised 50,757 records.
In 2023, we logged 77 such attacks, so 2024 looks set to surpass it. That’s the opposite trend we’re seeing in most other sectors and industries.
Other recent US government ransomware targets include Cleveland, OH, Newburgh, NY; Traverse City, MI; and Kansas City, MO.
About Shenandoah, TX
Shenandoah, Texas is a city in Montgomery County with a population of about 3,500 people.