Dallas County investigates cyberattack as ransomware gang claims responsibility
Add Axios as your preferred source to
see more of our stories on Google.

Illustration: Eniola Odetunde/Axios
Dallas County officials are investigating the scope of a cyberattack on the county's servers last month.
- The breach follows cyberattacks on the city of Dallas and the Dallas Central Appraisal District in the past year.
The big picture: Government organizations remain one of the top industries targeted by cyberattacks, according to a report by BlackBerry.
- Cyberattacks targeting government entities increased by nearly 40% from March to May in 2022 and 2023, the report says.
What happened: Dallas County learned about the breach "affecting a portion of its environment" on Oct. 19, per a statement released Monday.
- The county said in a notice to residents that it was able to prevent encryption of its files and systems after the incident was flagged.
- "There is no evidence of ongoing threat actor activity in our environment. … It appears at this time that the incident has been successfully contained and that Dallas County's systems are secure for use," the county said.
- County officials have hired an external cybersecurity firm to investigate what happened.
Meanwhile: The ransomware gang Play has reportedly taken responsibility for the attack, saying it took an undisclosed amount of data and threatening to leak it by Friday.
Zoom out: Cyberattacks are costly and time consuming.
- The Dallas Central Appraisal District paid $170,000 after a ransomware attack last winter, per the DMN.
- Several Dallas systems, including the municipal courts and library catalog, were offline for weeks after an attack in the spring. The city set aside $8.6 million to pay for its response to the attack, which affected at least 30,000 people on the city's group health plans.
- In June, Fort Worth experienced a data breach that resulted in information from an internal system to be posted online. The city said that no sensitive information was taken.
What we're watching: What data, if any, was taken in the attack and how long the county's network was compromised before the incident was flagged?
