photo by: Contributed

Douglas County Sheriff Jay Armbrister, left, and Eudora City Manager Zack Daniel

The cybersecurity incident that struck public computer systems in the City of Eudora and the Douglas County Sheriff’s Office was foreign ransomware that first hit the Eudora Police Department’s system, the city’s recently dismissed IT administrator said.

The attack — by a hacking group out of Eastern Europe or Russia — encrypted all of the police department’s files with ransomware, meaning the files were locked and a ransom was sought to unlock them.

“They don’t have the exact details or the location of the group,” Andrew Krulik, who was serving as the city’s sole IT employee during the time of the attack, told the Journal-World on Monday. “They just know that it is a popular hacking group, and they did leave a ransomware note.”

Krulik did not provide information about how much money the ransomware group is seeking in order to have the files unlocked.

The City of Eudora and the Douglas County Sheriff’s Office have said almost nothing about the mid-August strike, declining even to confirm that it was ransomware and that the incidents at the different agencies were related, as well as refusing to answer other repeated questions about the taxpayer-funded computer systems. The sheriff’s office, in rejecting an open records request from the Journal-World, said that sharing even basic information about the incident, which it referred to only as “suspicious activity,” would “jeopardize public safety.”

While Eudora City Manager Zack Daniel and Sheriff Jay Armbrister have said little about the problems caused by the attack, Krulik said it was “a big mess.” The Journal-World reached out to Daniel on Monday after receiving details from Krulik about the ransomware aspect of the incident. In a brief email response, Daniel did not address the ransomware aspect of the incident.

“The City is unable to comment on the factual circumstances of the recent network security incident,” Daniel said via email without elaborating on why the city can’t confirm that ransomware is part of the incident.

Daniel said the city has undertaken a review of its IT systems, and has expanded the contract of a third-party vendor that helps the city with technology issues.

“However, as part of the City’s ongoing efforts to strengthen its security posture, the City initiated a robust evaluation of the security mechanisms in place,” Daniel said. “As a result of this evaluation, the City engaged Infinity Technology Services as a third-party IT partner providing service to the City organization, adding to their existing scope servicing Eudora public safety departments since December of last year.  In doing so, the City put itself in a position to establish a consistent and secure IT framework across the many facets of the City’s environment.  In an effort to minimize the risk of a similar incident occurring in the future, the City will continue to evaluate its security posture and implement additional resources as deemed necessary.”

The expansion of that contract has seemingly cost Krulik his job. Krulik said his position was eliminated because the city told him it “didn’t want to run a one-man IT shop anymore and they were going to source the IT to a third party.” Krulik told the Journal-World that he has concerns about that strategy because the company that Eudora is using is the same firm that was responsible for overseeing the Eudora Police Department’s IT systems, which was compromised during this attack.

Additionally, Krulik said the city previously had been warned that such an attack could occur.

“I had asked for a security expert two years ago when Kevyn Gero was still the city manager,” he said, “and I never got anything like that. I basically warned them that something like this could happen because I didn’t have near enough money or resources to stop it.”

“And then all of a sudden it happened,” he said Monday, three days after the city terminated him.

Krulik provided additional information about how the cyberattack spread to the sheriff department’s IT system, and also provided details about how it is impacting operations at the city’s police department.

Krulik told the Journal-World that Eudora runs off of Douglas County’s servers for its police software and that the ransomware attack started with the Virtual Private Network, or VPN, that connects the police department to the sheriff’s office.

Krulik said that one result of the incident was that the police department lost almost all of its camera footage, although he does not know how much of that has been recovered.

“They’re basically on paper and pencil right now,” Krulik said.

Krulik, who said he was in charge of IT for Eudora’s City Hall, Parks and Recreation and Public Works departments, said the cyber-attackers did try to encrypt files in his realm but that he was able to stop it.

“I think they only got like maybe 2% of the files encrypted, so we never actually had to pay the ransom,” he said.

Now, the company overseeing the police department’s system, which was compromised, will be overseeing the security of the departments he had overseen, Krulik said.

“I’m just baffled by all of it,” Krulik said of the city’s decision, which he fears could have him looking like a “scape-goat” for the attack.

While Krulik said he questions the soundness of outsourcing the city’s IT security needs to a third-party vendor, he said the city does need to devote greater resources to its cybersecurity. He said he had talked to higher-ups about the need for more IT professionals given the size of Eudora — population 6,500 and counting.

“Every year they ask us what we need, and every year I filed for a security specialist and for another IT helper,” he said.

The cyber attack on the City of Eudora and the sheriff’s office has also had impacts on other agencies. The Lawrence Police Department had to disconnect from certain software that was connected to the sheriff’s office, as the Journal-World reported, and parties and witnesses appearing in Douglas County District Court have made references to video footage and reports not being immediately available as a result of the compromised computer system.