Baltimore Water Utility Hit by Ransomware; Operations Shifted to Manual Controls
A ransomware attack on Baltimore's Department of Public Works has forced the city's water treatment facilities to operate under manual controls while systems are restored.
The City of Baltimore's Department of Public Works has fallen victim to a ransomware attack that has disrupted operations at the city's water treatment facilities, forcing staff to implement manual controls to ensure continued service.
City officials stated that drinking water quality has not been affected and that there is no risk to public health. However, billing systems, customer service portals, and some monitoring functions remain offline.
"Our operational technology systems are isolated from our IT network, which prevented the attackers from affecting actual water treatment processes," said Baltimore DPW Director Richard Luna. "But we are operating under enhanced manual procedures as a precaution."
The attack, which occurred over the weekend, has been attributed to the Play ransomware group based on the ransom note and file extensions used to encrypt city systems. The group is demanding $5 million in Bitcoin for a decryption key.
Mayor Brandon Scott has stated the city will not pay the ransom. "We will not negotiate with cybercriminals," Scott said at a press conference. "We have backups and are working with federal partners to restore our systems."
This is the second major cyberattack on Baltimore city systems in recent years. In 2019, a ransomware attack crippled city services for weeks and cost an estimated $18 million in recovery and lost revenue.
CISA and the FBI are assisting with the investigation and recovery efforts. The incident highlights the ongoing vulnerability of municipal infrastructure to cyberattacks, with water utilities being an increasingly common target.