Both Hennepin County and Ramsey county are investigating cyberattacks that have targeted employee emails.
Hennepin County announced Thursday that 20 employees became victims of a sophisticated cyberattack targeting employee emails. The attack is ongoing, according to a statement.
The cyberattackers gained access to employee email accounts with credentials garnered through “phishing” emails that began arriving at the end of June.
“The attackers then sent malicious emails from those Hennepin County accounts,” said the statement.
SIMILAR SITUATION IN RAMSEY COUNTY
The email cyberattack in Hennepin County appears very similar to one experienced in Ramsey County, said John Siqveland, a Ramsey County spokesman.
On Thursday afternoon, “Ramsey County implemented security measures for all employee accounts following detected suspicious activity on our network,” Siqveland said in an email. “The email cyberattack compromised about 30 employee email accounts of some 4,000 total staff at Ramsey County.
“Throughout the days ahead, we will continue to assess the extent of the impact as we investigate the incident, and we will continue coordination with our partners in other agencies,” Siqveland continued.
HENNEPIN COUNTY REFERS CASE TO FBI
Hennepin County is also “assessing the extent to which private data may have been accessed” noting that some county employee emails could contain “private data about individuals to whom the county provides services.”
“Like many organizations, we’re increasingly facing threats of phishing attacks,” said Jerome Driessen, the county’s chief information officer. “We’ve been aggressively responding to and monitoring activity since the first indication, and increased our efforts to protect staff this week.”
The county has also notified vendors with which it maintains a business relationship and referred the matter to the FBI for investigation.
Approximately 20 county employees out of 9,300 total staff were compromised by the attackers.
Once the county completes its investigation, it will prepare and release a report that will be available to the public.
“Hennepin County takes its responsibility to protect resident data very seriously,” Driessen said. “We continue ongoing employee training and education. We also continuously enhance IT security measures to prevent increasingly sophisticated cyberattacks, and we hope this announcement can further dialogue about the increasing threats to all organizations’ cybersecurity.”