Royal ransomware disrupted City of Dallas police, court and dispatch systems

The City of Dallas confirmed on May 3, 2023 that a number of its servers had been compromised with ransomware. The attack took the Dallas Police Department and City Hall websites offline, and the municipal court cancelled jury trials and other court duties.

The computer-aided dispatch system used to route Dallas Fire-Rescue crews to emergency calls also went down, forcing dispatchers to work manually. Officials said 911 call handling itself appeared unaffected, and the city characterized the impact on service delivery as limited.

In a statement, the city said its team and its vendors were actively working to isolate the ransomware to prevent it spreading, to remove it from infected servers and to restore affected services. Residents having trouble reaching city services were directed to 311, or to 911 in an emergency.

BleepingComputer reported that the attack was the work of the Royal ransomware operation, identifying it from ransom notes that printed on network printers across city offices, which IT staff were told to preserve as evidence. Royal is generally described as an offshoot of the defunct Conti group and typically steals data before encrypting systems. The city did not confirm a ransom demand or say whether data had been taken, and released no further detail as of the reporting date.