San Diego cyber-attack included ransom note

Chief executive officer Randa Coniglio said the port, now operating normally, is partnering with the Federal Bureau of Investigation (FBI) and the Department of Homeland Security (DHS) to investigate the incident, first reported on 25 September, which he confirmed involved ransomware and a ransom note demanding an undisclosed amount to be paid in Bitcoin.

Speaking on 27 September Mr Coniglio said that “the investigation has detected that ransomware was used in this attack. The Port can also now confirm that the ransom note requested payment in Bitcoin, although the amount that was requested is not being disclosed.”

He stressed: “It is important to note that this is mainly an administrative issue and normal Port operations are continuing as usual. The Port remains open, public safety operations are ongoing, and ships and boats continue to access the Bay without impacts from the cybersecurity incident.”

While some of the port’s information technology systems were compromised by the attack, other systems were also shut down as a precaution, he explained.

He stated port employees continue to have limited functionality which may have temporary impacts on service to the public, especially in the areas of park permits, public records requests, and business services.

The port was last week determining the extent and timing of the incident, the amount of damage to information technology resources and developing a plan for recovery.