Analysis: Louisiana Government Cyberattack Could Have Been Worse

Article

The cyberattack on Louisiana’s state government computer servers disrupted agency operations and made going to the Office of Motor Vehicles even more headache-inducing than usual. But it was nowhere near the worst-case scenario, of widespread data theft and crippled government services for weeks or months.

Still, the ransomware hit serves as an indication of the new normal, where Louisiana technology officials are always trying to combat the latest attempted attack.

Sen. Sharon Hewitt praised the quick response from Louisiana’s technology services office to the Nov. 18 cyberattack, but also worried about vulnerabilities to another strike.

“Now that we’ve had this incident, does that put a target on our back, kind of, for more bad guys to hit our system?” the Slidell Republican asked during a meeting of the joint House and Senate budget committee.

The response from Neal Underwood, Louisiana’s deputy chief information officer, highlighted a grim reality of the computer age: “We get thousands of attempts to access our system every single day, 365 days a year.”

At least five school systems this year — in St. James, Tangipahoa, Sabine, Morehouse and Ouachita parishes — reported hackers that targeted their computer networks, infecting them with malware or ransomware. State officials helped to respond, and earlier this month, Gov. John Bel Edwards said the state also was working with the city of New Iberia to combat a similar attack.

In a sign of the times, Edwards listed his administration’s continued work to bolster Louisiana’s cybersecurity defenses among priorities for his second term, saying he expects more attempted cyberattacks.

“This is something that’s happening all across the country with increasing frequency,” Edwards said during his first news conference after his reelection win. “And it’s not going to go away.”

The Democratic governor had little chance to celebrate, with the cyberattack coming two days after the runoff victory.

Ten percent of Louisiana’s 5,000 state government computer servers were damaged by the hit, along with more than 1,500 of the state’s 30,000 computers, Underwood said. But he said the disruption wasn’t catastrophic. No data was lost, and no ransom was paid.

“I can assure you that none of the actual data in our enterprise was inappropriately accessed,” Underwood told legislators who appeared relieved.

The worst impact to the public seemed to be at the Office of Motor Vehicles, which shuttered all of its branch locations for a week while its computer systems were repaired. OMV offices then started opening in phases.

An investigation into the ransomware attack is ongoing. Underwood said the attack likely came from outside the United States, and he suggested it appeared linked to the similar hits to the parish school systems.

“These were very, very sophisticated, high-capability technology individuals. You don’t see those out there very often,” he said.

The Office of Technology Services immediately shut down external access to network servers when the breach was discovered. That caused a wider disruption of state government websites and email than the actual ransomware attack, Underwood said.

Edwards issued an emergency declaration to ensure that people and businesses don’t face fines or penalties because of the cyberattack 1 if they missed paperwork filing deadlines or saw their licenses expire, for example.

Attempting to fortify Louisiana’s cyber defenses, the governor has steered money and staff to the effort in his first term, and he’s pledged more.

The state established a cybersecurity emergency response team that includes leaders from the technology services office, the homeland security department, the Louisiana State Police, the Louisiana National Guard and university experts. Edwards also created a cybersecurity commission in 2017, aimed at finding ways to better prepare against attacks and to make Louisiana a leader in the field.

Edwards has supported work to expand the “cyber corridor” in north Louisiana that includes the Cyber Innovation Center, Barksdale Air Force Base and Louisiana Tech University.

In south Louisiana, the governor announced in August that Louisiana is spending $2 million to help establish a cybersecurity center in Baton Rouge. The center will analyze hacking threats and boost information sharing among state and federal agencies, industry experts and academics to strengthen computer network security.