Image copyright Alex Wroblewski/Getty Images Image caption Baltimore's government servers have been attacked by ransomware

The US city of Baltimore's government, long plagued by dysfunction, is now battling a ransomware attack that has crippled its systems for more than two weeks and counting.

Hackers breached the Maryland city's servers on 7 May and demanded $100,000 (£79,000) worth of Bitcoin.

The ransomware has blocked government email accounts and disabled online payments to city departments.

Baltimore city officials have so far refused to pay the ransom.

It is the second cyber-attack to strike the city in as many years - the last one knocked out its emergency dispatch system for about a day.

The FBI and Secret Service are investigating the latest breach.

How long will it last?

Baltimore Mayor Bernard "Jack" Young has acknowledged it is unclear when the systems will be back in operation this time.

"I know the folks in the technology office are working diligently to bring us back on board," said his spokesman, Lester Davis.

Aviel Rubin, a cybersecurity expert and computer science professor at Johns Hopkins University in Baltimore, estimates "conservatively" that it will be months before the systems are up and running.

"It's clear the system was vulnerable," he adds.

How damaging is the cyber-attack?

More than 1,500 homes sales have been delayed because the hackers left the city unable to notify insurers whether the sellers had any unpaid liens.

Baltimore this week rolled out a "manual workaround" to allow real estate transactions to proceed during the outage.

But citizens are unable to access online sites to pay their water bills, property taxes and parking tickets.

And 10,000 city government computers are locked, leaving employees with no email.

The city said there would be no late fees or fines during the technological shutdown.

Media playback is unsupported on your device Media caption Technology explained: what is ransomware?

What do the hackers want?

In the ransom note, obtained by the Baltimore Sun, hackers demanded payment of three bitcoins - currently worth around $23,600 - per system, or 13 bitcoins for the release of the entire government network.

If the city failed to pay within four days, the note said, the price would increase.

After 10 days - a deadline that lapsed last week - the city would not be able to get the data back.

"We've watched you for days and we've worked on your systems to gain full access to your company and bypass all of your protections," the hackers wrote.

"We won't talk more, all we know is MONEY!"

What makes the ransomware so effective?

The program, called RobbinHood, makes it impossible to access the servers without a specific digital key.

Prof Rubin said that the ransomware uses a publicly available algorithm called RSA to encrypt the data.

"It is believed that no government has the capability to break it," Prof Rubin said.

Without the key - held by the hackers - it's as if Baltimore's government "just lost everything", he said.

Baltimore has contracted computer experts to help.

Image copyright Getty Images Image caption The ransomware attack in Baltimore reflects wider cyber-security risks nationwide.

Have any other US cities been targeted?

Atlanta, Georgia, was hit with a similar breach in March 2018. That one was attributed to two Iranians.

Local media reported the hack cost the city $17m to recover.

Fortunately for Atlanta, the city had cyber-insurance, which helped the city foot the bill for its digital recovery. Baltimore had no such policy in place before this month's attack.

"This is impacting cities throughout the country," the Baltimore mayor's spokesman said.

"It's not a matter of if, it's a matter of when."

The Baltimore breach reflects a wider increase in ransomware attacks, Prof Rubin said, to which many government agencies have been slow to respond.

Hasn't Baltimore got enough problems?

Yes. Fallout from a sprawling corruption scandal in the city's police department has been playing out since 2017 after eight police officers were found guilty of robbing citizens and stealing overtime pay.

Earlier this month Baltimore Mayor Catherine Pugh resigned amid uproar over lucrative business deals for her self-published children's books.

Mr Young enjoyed no political honeymoon when he stepped in to replace Ms Pugh on 9 May - two days after the cyber-attack. </s> Thirteen bitcoins are standing between the city of Baltimore and many of the services and processes its citizens rely on after hackers seized thousands of government computers at the start of the month. The ordeal has been going on for two weeks, and there’s no clear end in sight.

Here’s what’s happening: On May 7, hackers digitally seized about 10,000 Baltimore government computers and demanded around $100,000 worth in bitcoins to free them back up. It’s a so-called “ransomware” attack, where hackers deploy malicious software to block access to or take over a computer system until the owner of that system pays a ransom.

Baltimore, like several other cities that have been hit by such attacks over the past two years, is refusing to pay up. As a result, for two weeks, city employees have been locked out of their email accounts and citizens have been unable to access essential services, including websites where they pay their water bills, property taxes, and parking tickets. This is Baltimore’s second ransomware attack in about 15 months: Last year, a separate attack shut down the city’s 911 system for about a day. Baltimore has come under scrutiny for its handling of both attacks.

The ransomware attacks in Baltimore and other local governments across the US demonstrate that as ransomware attacks spread, and as common targets such as hospitals and schools beef up their online systems’ security, there are still plenty targets vulnerable to this kind of hack. It also exemplifies the conundrum that ransomware victims face: pay up and get your access back, or refuse — potentially costing much more in the long run.

What’s going on in Baltimore, briefly explained

Hackers targeted the city of Baltimore on May 7 using a ransomware called RobbinHood, which, as NPR explains, makes it impossible to access a server without a digital key that only the hackers have.

The Baltimore hackers’ ransom note, obtained by the Baltimore Sun, demanded payment of three bitcoins per system to be unlocked, which amounts to 13 bitcoins to unlock all the seized systems. The note threatened to increase the ransom if it wasn’t paid in four days, and said the information would be lost forever if it wasn’t paid in 10 days. Both deadlines have now passed.

“We won’t talk more, all we know is MONEY! Hurry up! Tik Tak, Tik Tak, Tik Tak!” the note said.

The city government is refusing to pay, meaning that the government email systems and payment platforms the attack took down remain offline. The attack has also harmed Baltimore’s property market, because officials weren’t able to access systems needed to complete real estate sales. (The city said transactions resumed on Monday.)

Baltimore Mayor Jack Young, who’s officially been in his office less than a month, said in a statement on Friday that city officials are “well into the restorative process” and have “engaged leading industry cybersecurity experts who are on-site 24-7 working with us.” The FBI is also involved in the investigation.

“Some of the restoration efforts also require that we rebuild certain systems to make sure that when we restore business functions, we are doing so in a secure manner,” Young said. He did not offer a timeline for when all systems will come back online.

The Baltimore City Council president also plans to form a special committee to investigate this latest attack and try to ensure it doesn’t happen again.

A similar attack using RobbinHood hit government computers in Greenville, North Carolina, in April. A spokesperson for Greenville told the Wall Street Journal that the city never wound up paying, and that while its systems aren’t entirely restored, “all of our major technology needs are now being met.”

More than 20 municipalities in the US have been hit by cyberattacks this year alone. And such attacks can be expensive, perhaps especially if targets say they won’t pay. In 2018, hackers demanded that Atlanta pay about $50,000 in bitcoins as part of a ransomware attack. The city refused, and according to a report obtained by the Atlanta Journal-Constitution and Channel 2 Action News, the attack wound up costing the city $17 million to fix.

Ransomware attacks aren’t new — but we’re still figuring out how to deal with them

In 2017, a ransomware called WannaCry targeted tens of thousands of computers using Microsoft Windows operating systems in more than 100 countries. Officials in the US and the United Kingdom eventually blamed North Korea for the attack. Also in 2017, corporations in the UK, France, Russia, Israel, and Ukraine experienced ransomware attacks. US hospitals were also targeted.

Here’s how Timothy Lee explained for Vox what was going on and how ransomware had become more prolific:

The basic idea behind ransomware is simple: A criminal hacks into your computer, scrambles your files with unbreakable encryption, and then demands that you pay for the encryption key needed to unscramble the files. If you have important files on your computer, you might be willing to pay a lot to avoid losing them. Ransomware schemes have become a lot more effective since the invention of Bitcoin in 2009. Conventional payment networks like Visa and Mastercard make it difficult to accept payments without revealing your identity. Bitcoin makes that a lot easier. So the past four years have seen a surge in ransomware schemes striking unsuspecting PC users. Some ransomware schemes are so sophisticated that they even invest in customer service, helping victims who want to pay their ransoms navigate the complexities of obtaining bitcoins and making bitcoin payments.

Since then, a number of sectors and organizations have made improvements to their security practices to protect against ransomware. But the latest Baltimore attack exemplifies what a whack-a-mole game this is: One area improves its practices and hackers just go looking for another.

Recode and Vox have joined forces to uncover and explain how our digital world is changing — and changing us. Subscribe to Recode podcasts to hear Kara Swisher and Peter Kafka lead the tough conversations the technology industry needs today. </s> Approximately 10,000 Baltimore City government computers remain crippled after a cryptocurrency ransomware attack locked officials out of critical servers, basically paralyzing the city for 14 days and counting.

We were one of the first to report the May 7th attack that brought Baltimore's entire communication network to a standstill. Hackers wanted 13 bitcoins (about $100,000) on day one of the attacks but have since demanded $10,000 per day since city officials refused to pay the ransom late last week.

Mayor Bernard C. "Jack" Young has warned the attack continues to devastate the city, could take months to recover some servers.

Avi Rubin, a Johns Hopkins computer science professor and cybersecurity expert, told NPR the ransomware used in the attack is "unbreakable," and so powerful that even government specialists cannot crack the code to unlock the city's computer network.

"I don't even think that the NSA would be able to break this algorithm," Rubin said. "It's believed by the cryptographic community, both the theoreticians as well as the practitioners, to be unbreakable by today's technologies."

This is Baltimore's second cyber attack in a little more than a year. Last March, a ransomware attack on the city's emergency communications network forced dispatchers to relay addresses and other critical information to first responders via phone or text.

As the city remains paralyzed on Wednesday, numerous services provided by the local government are either offline or workarounds have been developed.

On the eighth day of the attack (May 15th), we reported the essential systems required for transacting real estate deals went offline, throwing the entire housing industry into chaos, which meant no homes could be bought or sold in the area. But it was only until yesterday, where officials launched a manual workaround for property sales.

Daniel Tobok, CEO of Cytelligence, whose company has advised 500 cities hit by ransomware attacks, told Fox News "he doesn't necessarily advocate paying off cyber crooks, he believes that in some instances "you don't have a choice, you have to make a business decision."

Tobok warned if city officials don't resolve the hack attack immediately, the economic damage to the city could be devastating.

"Baltimore is playing with time," he said. "They are going to come to a point where they have two choices - A. The (ransom demands) are going to skyrocket or B. The hackers will shut down the account they have been using and move out."

The FBI's cyber team has been working for 10-days straight to help Baltimore resolve their issues.

Baltimore City's Inspector General said the attack came about one week after a city employee was fired for downloading thousands of pictures of porn onto his work computer.

In the last month, separate cyber attacks have also affected Stuart City, Florida; municipality of Greenville, North Carolina; New York state; Cleveland Airport; Genesee County, Michigan; and Fisher County in Texas. </s> Google inadvertently thwarted Baltimore’s attempt to combat a major ransomware attack against the city earlier this week.

The Baltimore Sun reports that Baltimore set up multiple Gmail accounts after the ransomware attack, which affected the city’s email system, as well as services such as online payments.

On May 23, Google’s automated systems mistakenly perceived the numerous Gmail accounts as the work of spammers. The tech giant says that it has solved the issue, enabling Baltimore officials to use Gmail.

"We have restored access to the Gmail accounts for the Baltimore city officials,” it explained in a statement emailed to Fox News. “Our automated security systems disabled the accounts due to the bulk creation of multiple consumer Gmail accounts from the same network."

The computer servers were hit by the cyber attack on May 7 and city officials quickly shut down most servers. The city put a statement on its website saying that it "is currently unable to send or receive email.” If residents need service from the city, they have been asked to call the city department they need to contact.

Officials have said hackers using the ransomware variant RobbinHood demanded the city pay the equivalent of $76,000 in bitcoin, which Mayor Bernard Young says won't happen. The deadline for payment was May 17.

Fox News has left multiple messages with Baltimore officials with a request for comment on this story.

In a ransomware attack, hackers typically encrypt a computer network’s data to hold it “hostage,” providing a digital decryption key to unlock it for a price.

Last year, the City of Atlanta was targeted in a ransomware attack that impacted a number of its systems.

Attacks have taken place across the U.S. Hackers, for example, targeted the port of San Diego in a ransomware attack that disrupted the agency’s IT systems. An Alaskan borough also had to dust off its typewriters following a major ransomware attack.

In 2017, a major ransomware attack forced the shutdown of a host of IT systems at Mecklenburg County, North Carolina.

Also in 2017, a hacker targeted Sacramento Regional Transit, deleting 30 million files in a ransomware attack. Officials worked to restore the data from backup files.

CLICK HERE TO GET THE FOX NEWS APP

In 2016, a Los Angeles hospital paid a ransom of nearly $17,000 in bitcoins to hackers who infiltrated and disabled its computer network.

Fox News’ Barnini Chakraborty and the Associated Press contributed to this article. Follow James Rogers on Twitter @jamesjrogers </s> Visitors to Baltimore’s government website this week saw a banner message that might be jarring for a city that’s taken pride in its high-tech “smart city” initiatives.

“The City of Baltimore is currently unable to send or receive email,” the banner read. “If you need assistance, please call the department you wish to contact.”

That comes after the city’s computer network was struck by a massive ransomware attack that Mayor Bernard “Jack” Young said on May 17 could take months to fully recover from.

“We don’t have any [recovery] date as of now,” says James E. Bentley II, press secretary in the mayor’s office. “They’re just working around the clock to secure the environment, and then once they are certain that they have a secure environment, they’re going to start working incrementally to bring applications and email back online.”

The hack, first discovered on May 7, also interfered with real estate sales in the city since officials couldn’t verify that sellers didn’t have outstanding liens on their properties. The city has since introduced a new procedure effectively letting sales resume if sellers pledge to pay any outstanding debts on their properties. The attack also shuttered a “bad batch” warning system that lets drug users and healthcare workers know when there are especially deadly drugs being sold in the area, The Baltimore Sun reports, and made it impossible for residents to pay water bills and parking tickets online.

The city government has so far refused to pay a 13-Bitcoin, or roughly $100,000, ransom demand that the attackers have claimed would let the city unlock files encrypted by the attack, which used a malware variant nicknamed RobinHood to encrypt city data.

It’s not the first time government computers have been struck by ransomware—Albany, New York, suffered brief digital disruptions in April after a similar attack, and Atlanta reportedly took months and spent millions of dollars to recover from such an attack last year, allegedly the work of Iranian hackers. And experts warn that such hacks on government systems could continue, with municipalities in particular often struggling to keep up with the demands of cybersecurity. </s> Earlier this month, hackers successfully deployed a piece of ransomware that, for about two weeks now, has effectively shut down a range of key public services in the city of Baltimore. All told, the ransomware in question has locked down approximately 10,000 government computers. The hackers responsible for the attack — who remain unknown at this point — are demanding 13 bitcoins in exchange for returning things back to normal, a figure that comes out to about $102,000.

The ransomware attack has essentially taken the Baltimore city government hostage. What this means on a practical level is that the city government cannot access email accounts or even process payments to employees. Further, real estate transactions cannot be processed and citizens remain unable to make a range of utility payments.

As it stands now, city officials have indicated that they have no intention of paying the ransom amount, which is encouraging insofar that paying the 13 bitcoins would undeniably encourage similar attacks in the future. But in the interim, there’s something of a standstill as the city is working furiously to get essential services back up and running.

In a press release issued a few days ago, Baltimore Mayor Bernard Young said the following:

We established a web-based incident command, shifted operations into manual mode and established other workarounds to facilitate the continued delivery of services to the public. We continue to adjust and refine the delivery of those services that were only partly interrupted and to pursue ways to reactivate any services that were completely interrupted. We are well into the restorative process, and as I’ve indicated, are cooperating with the FBI on their investigation. Due to that investigation, we are not able to share information about the attack. To the extent that we can, we will continue to keep you informed about our process.

Meanwhile, Young added that the city is working with leading cybersecurity experts as part of an effort to contain the ransomware and implement updated tools to ensure that a similar attack won’t happen again. Further, Young notes that a timeline for when everything will return to normal remains unclear and that some systems may not be fully restored for a period of a few months.

“Like any large enterprise,” Young explained, “we have thousands of systems and applications. Our focus is getting critical services back online, and doing so in a manner that ensures we keep security as one of our top priorities throughout this process. You may see partial services beginning to restore within a matter of weeks, while some of our more intricate systems may take months in the recovery process.”

Now if any of this sounds somewhat familiar, Baltimore’s 911 system was hit by a ransomware attack last year. Fortunately, the 911 system was spared this time around.

As to the ransomware used in the attack, the Baltimore Sun notes that it’s a new variant of ransomware dubbed RobbinHood. Experts who have taken a close look at it have indicated that it was “written by experienced coders.”

Over the past few years, ransomware has become an increasingly favored tool among hackers looking to generate a boatload of cash with a relatively quick turnaround. While we’re accustomed to seeing ransomware attacks target individual PC owners, hackers seem to be targeting government computers with increasing — and alarming — frequency. Just last month, for example, a ransomware attack caused myriad issues at Cleveland Hopkins International Airport. </s> The US city of Baltimore has been partially paralyzed since 7 May, when a ransomware attack seized parts of the government’s computer systems.

As soon as the city discovered that it had been attacked, it informed the FBI and took its systems offline in an effort to keep the infection from spreading.

But not before the attack took down voicemail, email, a parking fines database, and a system used to pay water bills, property taxes and vehicle citations. Real estate transactions were also shut down.

It was lousy timing, given that this is one of the real estate industry’s busiest times of the year. The Baltimore Sun reported that hundreds of property sales could have been affected: A real estate agent with access to industry data told the newspaper that at least 1,500 sales were pending in Baltimore.

But a sliver of good news came on Monday, when Mayor Bernard Young’s office announced that the city had developed a manual workaround that would allow real estate transactions to resume during the outage.

On Friday, the mayor’s office had said that the city is “well into the restorative process.” The work includes rebuilding some systems in a way that will ensure that when business functions are restored, they’ll be functioning securely.

According to Fox News, a recent analysis of the city’s cybersecurity defenses found that the network was “out of date in terms of security, staffing, and infrastructure to prevent attacks.”

Unlike both Greenville and Atlanta – which was hit by a SamSam attack last year – Baltimore doesn’t have an insurance policy to cover cybersecurity incidents. Baltimore’s head of computer security reportedly told City Council members last year at a budget hearing that the city needed one, but it didn’t happen.

Expect that to change: a spokesman for Young told the Baltimore Sun that the mayor has now directed the city’s finance and law departments to get coverage.

In Friday’s update, Mayor Young’s office said that it could take months to restore all services. From the media release:

The city has established a web-based incident command, shifted operations into manual mode and established other workarounds to keep delivering services.

The ransom: 13 Bitcoins for all you can eat

Baltimore has a choice: it can spend months getting its technology back online, or it can give in to the attackers’ demands. 13 Bitcoins – worth about US $100,000 – is now standing between Baltimore and what would purportedly be a full restore of its systems. Mayor Young told local reporters on Monday that the city might pay up at some point, but at this point, that’s a negative:

In recent months, we’ve covered several severe attacks, including one in which the malware author behind a new type of ransomware called MegaCortex geeked out and distracted victims with Matrix film references.

We saw another attack at the beginning of the year, against a slew of US newspapers, that delayed their publication. And then in February, a targeted attack against a hospital involved two GandCrab ransomware attacks.

What to do?

Defending against a determined, targeted attack demands defense in depth, and, as in many things, prevention is better than cure. That starts with ensuring that access to RDP (Remote Desktop Protocol) is secure and finishes with regular, comprehensive, off-site backups, with much else in between.

To read more about those things and the preventive steps you can take to protect yourself against targeted ransomware of all stripes, read our article on how to defend against SamSam ransomware.

Fortunately, the same advice that we gave to help to protect from SamSam will also help against ransomware – and cybercrime – in general, so please revisit it now.

We also urge you to read the SophosLabs 2019 Threat Report, in which Sophos researchers analyze the state of play in cybercrime today, including a section on ransomware.

Finally, visit sophos.com to read more about anti-ransomware technologies, including Sophos Intercept X. </s> For more than two weeks now, Baltimore has been battling a major ransomware attack on its city government infrastructure. The city government’s email, voicemail, property tax portal, and water bill and parking ticket payment systems have all been affected, and more than 1,000 pending home sales have been delayed. (To add insult to injury, the Baltimore Sun reported Thursday that “Gmail accounts created by Baltimore officials as a workaround while the city recovers from the ransomware attack have been disabled because Google considers them business accounts that should be paid for, the mayor’s office said.”) The cause of these problems is a relatively new strain of malware called RobbinHood, which, like other ransomware programs, encrypts infected systems so that they cannot be used or accessed until a payment is made and the attackers provide the necessary decryption key. It’s a deeply frustrating type of cybersecurity incident because it interrupts operations so completely. Even if a victim is perfectly prepared with full offline data backups, it still requires time and resources to reboot all of the infected computers.

So far, Baltimore’s response appears to have been admirable, if slow. It’s taking systems offline to prevent the malware from spreading and setting up an offline alternative to the online system for processing home sales, for instance. But in an interview on Monday, Baltimore Mayor Bernard Young hinted that he might be considering the worst possible response: giving in to the attackers’ demands for a payment of 13 bitcoins, or roughly $100,000.

Young didn’t say he would authorize the payment, but he showed signs of caving to the pressure, telling reporters, “I am thinking. Right now, I say no, but in order to move the city forward? I might think about it. But I have not made a decision yet.”

From a financial perspective, it makes perfect sense that Young would consider acquiescing to the ransomers’ demands—after all, it will cost the city far more than $100,000 to restore the systems that have been compromised. But long-term, that cost-benefit analysis looks very different. Every time a victim pays up in a situation like this, it simply allows the perpetrators to continue with this line of cybercrime—and, more than that, encourages others to follow in their footsteps, because it reinforces the idea that this is a viable and lucrative business model.

Baltimore stands to put the rest of us in greater danger by paying the ransom.

Even Young just publicly stating that he is considering making such a payment may be enough to encourage future such attacks on Baltimore, by signaling to would-be attackers that the city has not ruled out the possibility.

When the city of Atlanta experienced a similar ransomware attack in 2018, media coverage noted the irony of the city’s spending $2.6 million to recover from the incident rather than paying the demanded $52,000. But while Atlanta’s recovery spending was perhaps excessive (the consultancy fees it paid for “incident response consulting” and “crisis communications services” were ludicrous), they had exactly the right idea in refusing to give in to the ransom demands.

There are multiple reasons it’s a bad idea—both financially and ethically—to pay a ransom in any circumstances short of life and death. However frustrating the Baltimore situation may be right now, the inability to pay parking tickets or purchase a house does not reach the bar of, for instance, a hospital unable to administer care to patients because of ransomware.

From a purely self-interested perspective, there’s a real risk that Baltimore could pay and then find that the attackers do not actually restore their systems—or demand more money before doing so. According to a 2016 study by Kaspersky Lab, roughly one in five ransomware victims who pay their attackers are still not able to retrieve their data. (As a sort of insurance against that risk, the Baltimore hackers have allegedly offered to decrypt three files at no charge to show they are “honest,” according to the New York Times.)

Even if the RobbinHood perpetrators restore Baltimore’s computer systems upon receiving payment, that’s still no guarantee they won’t return to attack the city again in the future. They may even leave traces of malware or backdoors on the city’s systems to ensure their ability to do so. And even if those particular perpetrators move on to other targets, other attackers will know that the Baltimore government is a promising target, liable to give in to demands if the attack is sufficiently severe.

Beyond just opening itself up to more trouble and future ransom demands, Baltimore also stands to put the rest of us in greater danger by paying the ransom. For the most part, cybercriminals only continue to spread ransomware because it is a profitable business—one 2017 study found ransomware payments over a two-year period totaled more than $16 million.

So, yes, it’s important to make regular, automated backups of all your systems; it’s important to segment your network so that it’s hard for malware in one part to spread to all the others; it’s important to have offline alternatives to online systems; it’s important to be careful about suspicious websites and email attachments. But none of those things, on its own, is going to drive ransomware out of business. The only two things that have the potential to really dramatically drive down the frequency of ransomware attacks are a global crackdown on regulating cryptocurrency exchanges (which does not appear to be imminent) or a widespread refusal to pay ransoms that forces cybercriminals into another line of work to pay their bills.

No one should be paying ransoms, but public entities, like city governments and police departments, have a particular responsibility to protect the public good by doing the slow, hard, expensive work of restoring and securing their systems rather than taking the easy way out—which will, in the end, only make everything harder.

Future Tense is a partnership of Slate, New America, and Arizona State University that examines emerging technologies, public policy, and society. </s> U.S. Sen. Chris Van Hollen and other Maryland lawmakers have lots of questions for the FBI about the ransomware attack on Baltimore City government computer systems.

The lawmakers are seeking a briefing on, among other topics, what federal resources were provided to respond to the attack and how the city can enhance its cybersecurity.

In a letter being sent Thursday to FBI Director Christopher Wray and Secret Service Director James Murray, the legislators also ask for the attackers’ identities and details about similar cases in other states.

The briefing would not be held until the attack is over “and any subsequent investigations conclude,” the letter said.

It said the Maryland delegation is “deeply grateful to the FBI and Secret Service for providing much-needed assistance to the City in responding to this attack.”

Baltimore officials said the attack earlier this month knocked email and payment systems offline and halted the city’s real estate market operations. Baltimore’s property market was revived Monday only after officials launched a manual system for processing sales.



Ransomware works by locking up files using encryption so users can’t access them. The hackers then demand payment to provide the cyber keys to unlock the files, typically in the hard-to-trace digital currency bitcoin. Because this strain is new, it can slip past anti-virus tools.



“As you know, this attack has caused significant disruptions to the daily operation of City services, delaying at least 1,500 pending home sales and affecting how residents pay bills and other obligations,” said the letter, signed by Van Hollen and fellow Democratic senator Ben Cardin.



Reps. Elijah Cummings, C.A. Dutch Ruppersberger and John Sarbanes — all Baltimore-area Democrats — also signed.
The U.S. city of Baltimore, Maryland, has been battling a ransomware attack that has blocked government email accounts and disabled online payments to city departments. The hackers breached the city's servers on May 7 and demanded $100,000 (£79,000) worth of Bitcoin.