Netgain Ransomware Incident Impacts Local Governments

The ransomware incident that Netgain, a provider of managed IT services, had late last year rippled onto its customers. Now, Ramsey County, Minnesota, is informing clients of the Family Health Division program that the hackers may have accessed personal data.

The government of Ramsey County learned about the potential breach on December 2, 2020, when Netagin let them know of the attack and the impact it could have.

Thousands of clients affected

“Netgain determined that the ransomware incident affected data within an application used by Ramsey County’s Family Health Division to document home visits” – Ramsey County Government

In a notification last week, Ramsey County says that the data that may have fallen into the hands of the hackers could include names, addresses, dates of birth, dates of service, telephone numbers, account numbers, health insurance information, and medical information.

In some cases, the Social Security number may also have been exposed.

Data of as many as 8,700 clients has been impacted and Ramsey County is not the only local government affected by this attack.

Also Read: 10 Practical Benefits of Managed IT Services

As soon as they learned of the attack, Ramsey County took steps to address and mitigate the effects. They dropped Netgain’s services and switched to backup processes.

Ransom may have been paid

The attack against the IT services provider occurred on November 4 and resulted in Netgain taking offline some data centers to stop the unauthorized encryption process to spread across the network.

It is common practice for ransomware gangs to steal data before encrypting it as this would help them pressure the victim into paying the ransom.

Providers of managed services are an attractive target to ransomware gangs because they can extend the damage further down the line and hit multiple companies, so they can ask for a larger ransom and get paid.

Although BleepingComputer reached out to Netgain for details about the attack, we never received a reply. However, some sources affected by the incident told us that REvil ransomware gang was behind the attack.

The same sources told us, allegedly based on information from a Netgain account manager, that the company paid the hackers for the tool that decrypted the locked data.

Also Read: What Legislation Exists in Singapore Regarding Data Protection and Security?

BleepingComputer could not verify these details independently beyond doubt.