Bitcoin ransomware attack cripples Johannesburg’s government, bank services

Ransomware demanding Bitcoin has forced the city of Johannesburg to shut down all its e-services after its network was breached by the hacker group called ‘Shadow Kill Hackers,’ reported Business Day. The hackers have put forth a ransom demand of 4 BTC before the government and have threatened to leak confidential data online if their demands are not fulfilled by 28 October.

While Joburg isn’t the first city or town to be given such a ransomware demand, it is probably the biggest to face such a crisis. Johannesburg is South Africa’s largest city and is the largest contributor to the country’s National Economic Product.

The hack has affected not just government services, but several banks have also reported Internet-related issues over the same time period as when the government website was breached. The Standard Bank, Absa and three other banks were reported to have been affected.

Johannesburg Municipal Community’s Twitter handle was the first to break the news about the breach in the network, stating that the network breach was the reason behind the shutdown of computers, billing services, Internet-based customer care services and several other government e-services.

The hacker group in their ransom note warned the government regarding the sensitive information in their possession, claiming that if their demands are not met, they would leak everything on the Internet. The ransom note read,

“All your servers and data have been hacked. We have dozens of back doors inside your city. We have control of everything in your city. We also compromised all passwords and sensitive data such as finance and personal population information”

The city has already launched an investigation to look into the hacking and the investigation is supposed to take 24 hours. However, this is not the first ransomware attack that the city has faced. 3 months ago, Johannesburg’s city power was hit by a Bitcoin ransomware attack as well, which resulted in the facility’s database being encrypted and the whole network being compromised.