Washington County, Pennsylvania paid a $350,000 ransom after January cyberattack

Washington County, Pennsylvania, paid roughly $350,000 to ransomware operators to regain control of its government network after an attack that began in January 2024. County officials identified the intrusion on January 19 and shut down servers on January 24 following a warning from the federal Cybersecurity and Infrastructure Security Agency.

County Solicitor Gary Sweat said the attack had essentially paralyzed county operations. Forensic investigators confirmed on February 5 that data had been stolen, and the attackers set a payment deadline of 3:30 p.m. on February 6.

At an emergency meeting on February 6, the county Board of Commissioners voted 2-1 to authorize up to $400,000 to resolve the incident. The county ultimately sent $346,687 to the attackers and paid a fee of about $19,000 to DigitalMint, a Chicago cryptocurrency firm that handled the transaction. Commissioner Larry Maggi voted against the payment and called it repugnant.

Board Chairman Nick Sherman said the county paid because the stolen records included sensitive information on children in the county court system, including abuse and abduction cases, and because officials did not want that material published on the dark web. Sherman said the attackers were believed to be based in Russia.

A decryption key was delivered after payment, and county officials said about 80 percent of systems had been restored as of mid-February 2024.