Oakland ransomware attack nears 2 months

OAKLAND, Calif. - Friday will mark two months since the City of Oakland's Information Technology system was ransacked and disabled by ransomware hackers causing city employees and residents headaches and loss of personal information. 

It took effort, but the latest efforts produced some reluctantly-given information.

"We, we need to be better as city leaders so that you all can do your job," said Oakland Mayor Sheng Thao addressing city workers at a noon employee rally Wednesday. 

A day before, the city website reported that more personal information of certain current and former employees and a limited subset of residents, such as some individuals who filed a claim against the City or applied for certain programs, was found on the dark net.

The dark net is a marketplace on the internet where criminals can buy, sell and trade stolen information.

"We're hopeful that this will be the last dump. It is a large amount, but it's an ongoing investigation," said the Thao.

PREVIOUS COVERAGE: Oakland's ransomware attack intensifies as city struggles to respond

That has been the way Thao and her administration have avoided answering real questions about how bad the damage is and how long it might last. 

"This is a sensitive situation. For ransomware, you can consider these terrorists. We're working with the FBI and just like the FBI will tell you, this is an ongoing investigation," she said. "It's my understanding that we're now at about 85% running in regard to all of our systems…"

Translated: the horse has been taken from the barn, but the door is now securely locked. 

According to the Information Security Ransomware Task Force, the average downtime is about 21 days with Oakland almost three times that. Full recovery takes, on average, 287 days from the initial ransomware incident response which would put the total recovery date on Nov. 22.

The City of Oakland writes: "We encourage any individuals who receive a letter to contact the dedicated call center with any questions about the notice and how to sign up for services as applicable. That number is (866) 869-1861, and it is open Monday through Friday, 8:00 a.m. to 5:00 p.m., Pacific Time."

Anyone with additional questions about the ransomware attack can find more information and contact city officials here.