Days after the attack, a ransom demand arrived. It was shockingly high, city officials said. They declined to say exactly how much it was because the investigation is still underway.
The city’s insurer, the Florida League of Cities, hired a consultant to handle the negotiations with the hackers via the email addresses that had been posted on the city server.
The initial demands were refused outright, and city technicians raced to find a workaround. “We tried a lot of different solutions,” said Mr. Helfenberger. None of them worked. “We were at the end of the day faced with either recreating the data from scratch, or paying the ransom,” he said.
The insurer’s negotiator settled on a payment of 42 Bitcoins, or about $460,000, Mr. Helfenberger said, of which the city would pay a $10,000 deductible.
After the payment, the hackers provided a decryption key, and recovery efforts began in earnest.
As it turned out, recovery would not be simple. Even with the decryption key, each terabyte has taken about 12 hours to recover. Much of the city’s data, nearly a month after the onset of the attack, has still not been unlocked. “I thought it would be restored a lot sooner,” Mr….
