Cyberattack Disrupts US Emergency Alert Systems
Recent cyberattacks have severely disrupted emergency alert systems across the United States. The attack targeted the CodeRED system, a service provided by the vendor Crisis24, affecting various municipalities.
Emergency Alert System Outage
Following the breach, several towns and cities announced that residents could not access the CodeRED emergency alert system. This service, crucial for disseminating real-time alerts regarding emergencies such as weather warnings and terror threats, has now been compromised. Authorities, including the Douglas County Sheriff’s Office in Colorado, have terminated their contracts with CodeRED and are actively seeking alternatives.
Crisis24’s Response
Crisis24 is in the process of developing a new CodeRED platform, which will operate in a secure environment that is entirely separate from the compromised system. The company assured customers that the new platform has undergone a comprehensive security audit and additional testing. They emphasized their commitment to protect personal information throughout this transition.
Security Measures and Alerts
- Residents were advised to change their CodeRED passwords to ensure security.
- The stolen data may include names, addresses, email addresses, phone numbers, and passwords.
- The City of University Park, Texas, confirmed that the migration to a new alert platform is underway.
In the interim, affected regions are relying on social media and door-to-door communication to share important notifications with residents. Local authorities have communicated that not all users of CodeRED created full profiles, but for those who did, changing the credentials for accounts using the same passwords is strongly advised.
Investigation and Findings
Crisis24’s internal communications revealed information about the breach. They stated that while attack impacts were confined to CodeRED, rising cybersecurity threats have become a serious concern globally. The INC ransomware group claimed responsibility, stating their affiliate accessed Crisis24’s network on November 1 and encrypted files by November 10.
Ransom Negotiations
Throughout the ransom negotiations, chat logs indicated initial demands of $950,000, later reduced to $450,000. Crisis24’s offers began at $100,000, eventually rising to $150,000, all of which were rejected by INC. The group has threatened to sell the stolen data if their demands are not met.
As this situation evolves, Crisis24 has reiterated its commitment to supporting affected clients and ensuring that all basic alerting functions remain operational. The company’s actions aim to rebuild trust and enhance security measures in the wake of this significant cyber incident.
