IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Recovery costs for Baltimore hack to exceed $18m

Cleanup effort and lost revenue is expected to cost more than 180 times the initial ransom

The devastating ransomware attack that crippled the city of Baltimore's public services for more than two weeks will cost approximately $18.2 million (14.3 million) to put right, according to the city's mayor.

Cleanup efforts in the immediate aftermath of the attack will cost Baltimore $10 million through to the end of the year, according to mayor Bernard Young, speaking at a council hearing last week. Meanwhile, an additional $8 million in costs have been sustained due to deferred or lost revenue while the city was unable to process payments.

The city's IT office has already spent $4.6 million on recovery operations since the attack on 7 May, city officials revealed, with an additional $5.4 million earmarked to be spent by the end of the year, according to the Baltimore Sun.

"We're not going to pay criminals for bad deeds. That's not going to happen," Young said in response to questions over the expected costs, adding: "There's no guarantee that if you pay, you reset your system".

For more than two weeks in May, thousands of government computers were infected with malware, said to be a strain known as RobinHood. This shut down a string of government services including those for paying taxes and parking tickets, as well as internal email systems.

In contrast with the eye-watering costs of the hack revealed this weak, the hackers asked for just 13 bitcoins, valued at just under $100,000 at the time. 

Mayor Young has since faced criticism over his handling of the attack, with his repeated refusal to pay the ransom being branded as "shortsighted" by Forrester analyst Josh Zelonis.

"While many advise against paying ransoms, Forrester has been tracking a trend of companies that negotiated with the extortionists and paid for decryption keys as part of their incident recovery," he said.

"Conventional wisdom does not factor in what is best for your business and the situation you are currently in. Platitudes and emotion are not going to help you formulate an optimal recovery path for your business."

Meanwhile, recovery is complicated, and even if there are good backups, businesses tend to underestimate the scale of disruption that needs to be planned ahead for, he added.

Additional reports have since indicated the perpetrators used a Windows exploit developed by the National Security Agency (NSA) to target the city. The EternalBlue tool also exploits a vulnerability with Windows XP and Vista systems, also called EternalBlue. This flaw allows hackers to execute commands remotely on targeted devices.

The exploit has also been at the centre of a number of infamous cyber attacks including the WannaCry attack of May 2017 and NotPetya in June the same year.

The former had a particularly devastating effect on the NHS, costing the health service more than 92 million to recover. The bulk of these costs, 72 million, were allocated towards restoring its services to full operation and recover data in the immediate months following the attack.

Featured Resources

The Total Economic Impact™ Of Turbonomic Application Resource Management for IBM Cloud® Paks

Business benefits and cost savings enabled by IBM Turbonomic Application Resource Management

Free Download

The Total Economic Impact™ of IBM Watson Assistant

Cost savings and business benefits enabled by Watson Assistant

Free Download

The field guide to application modernisation

Moving forward with your enterprise application portfolio

Free Download

AI for customer service

Discover the industry-leading AI platform that customers and employees want to use

Free Download

Recommended

Ransomware now strikes one in 40 organisations per week, Check Point finds
ransomware

Ransomware now strikes one in 40 organisations per week, Check Point finds

27 Jul 2022
Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022
Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
Out-of-hours ransomware attacks have a greater impact on revenue
ransomware

Out-of-hours ransomware attacks have a greater impact on revenue

18 Nov 2021

Most Popular

Apple patches 'superpower' zero-days affecting iPhones, iPads, and Macs
zero-day exploit

Apple patches 'superpower' zero-days affecting iPhones, iPads, and Macs

18 Aug 2022
Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
Google is now spending a staggering amount on blockchain
Business strategy

Google is now spending a staggering amount on blockchain

17 Aug 2022