LOUISVILLE, Ky. — Weeks after a ransomware attack shutdown every branch of the Jefferson County Clerk's Office in July, officials have confirmed "some information" was stolen in the cyberattack.
Previously, the clerk's office said no data was breached or compromised in the hack. Ashley Tinius, a spokesperson for the clerk's office, said officials learned about the lost information Monday morning.
At this time, however, officials have not shared what information was taken or the impact on local residents.
The clerk's office said it believes the attack was a random bot attack sent across the web, and may have been a result of hackers taking advantage of the global CrowdStrike outage.
"We don’t know if ours was part of CrowdStrike at all,” Tinius said. "All we know is that when the hackers began that bad acting program after CrowdStrike, ours happened a few days later after all of the CrowdStrike incidents. So we can’t say for certain if it was involved with that."
WHAS11 obtained a photo of the note left by the hackers through an open records request.
In the letter, hackers offered to restore all the offices’ systems in exchange for an undisclosed amount of money and only if the office didn’t inform anyone of the attack.
"There is no dollar amount," Tinius said. "There was no negotiation, and all it said on the message was to get your information back you need to contact us."
She added that the clerk's office never contacted the hackers about negotiating a ransom.
“When you open yourself up to one negotiation, you’ll open yourself up to another attack,” Tinius said. “So, we followed the rules and protocols that Homeland Security and the FBI, everyone said don’t negotiate with them.”
'We need support.'
Representatives for the Jefferson County Clerk's Office will be in Frankfort on Wednesday to answer questions from lawmakers about the office's forensic report into the cyberattack.
"Basically, we need support and any type of support we can gain from the legislature would be helpful," Tinius said. "Whether they can offer extra IT support, extra financial support, because these things can be very labor and cost intensive."
Customers think releasing the investigative report to the public is the right step to take after the attack.
"Really our government agencies have a lot of information that needs to be protected," David McCay said. "They probably may not have as much as robust resources to do that compared to private companies. I think it's a good thing."
As of Monday, every branch of the clerk's office has reopened and fully functioning.
The clerk's office wants to ensure the public that they are taking short and long-term steps to make sure that if a similar attack were to happen again, they would know how to handle it.
Make it easy to keep up-to-date with more stories like this. Download the WHAS11 News app now. For Apple or Android users.
Have a news tip? Email assign@whas11.com, visit our Facebook page or Twitter feed.