Chennai: The Tamil Nadu Public Department is said to have come under a ransomware attack and has encrypted certain sensitive documents since Friday morning. According to official sources, some of the files encrypted relate to VIP visits, their programmes and related arrangements made by State Protocol officials.
The suspect has demanded payment of $1,950 in cryptocurrency as ransom for handing over the decryption code. Meanwhile the cyber security experts from the Centre for Development of Advance Computing (C-DAC) and Computer Emergency Response Team are trying to retrieve the encrypted documents, sources in the State Secretariat said.
Soon after the ransomware attack, officials C-DAC from the C-DAC inspected the desktop computers that displayed a message from the suspect demanding payment of ransom in cryptocurrency, the sources said.
The State Government’s Electronics Corporation of Tamil Nadu (ELCOT) has a tie-up with C-DAC for e-governance and cyber security management issues.
Of the 12 desktop computers used at the particular section in the Public Department, about 8 were found to be operating on the Windows-7 Operating System which was an outdated platform with little or no support from Microsoft. The desktop computers therefore had no security/software updates and anti-virus mechanism to prevent ransomware or other cyber attacks.
The Tamil Nadu police who inspected the desktop computers said there was no compromise whatsoever on VIP security protocol or any other matter that could affect the routine functions of the State government.
“We need an effective IT security policy and First Responders in computer forensics to handle such situations. Use of outdated operating systems with no software updates and anti-virus protection remains a threat. The ransomware is click-based and could have landed in the form of a Whatsapp message (opened on a desktop computer), email, pop-up etc,” a senior official who is part of the investigation team said.
According to cyber experts, there has been an increase in ransomware attacks in recent times. Suspects operating from unknown locations often target prominent personalities and demand payment of ransom by claiming that they had access to sensitive personal data or websites visited by them.
Discussion about this post