The ransomware group ALPHV (BlackCat) has published a first part of exfiltrated data from the Town of Iowa in the state of Louisiana.
Approximately 250 scanned documents in PDF format have been released, some of which contain visible Social Security numbers (SSNs) of employees, employee salaries, balance sheets, birthdates, addresses, phone numbers, and other personally identifiable information (PII). The documents also include administrative records from the Police Department and Fire Department of the city, the Bank Reconciliation Report – Appearance Bond, and more. These documents predominantly pertain to the years 2019 and 2020.
Among the documents published by ALPHV is a 2020 insurance policy regarding the “Terrorism Risk Insurance Act” (TRIA) as defined in Section 102(1) of the Act. Starting from January 2020, the insurance provided coverage for acts of terrorism at 80%, including the possibility of extending the policy to cover cybercrime, but the municipal administration had decided not to utilize this option. The insurance also included the option to extend coverage in the event of a cyberattack. The insurance waiver was signed on January 30, 2020, by Paul Hesse, who was the Mayor of the Town of Iowa at that time.
Below is an excerpt from the insurance policy.
In the subsequent images, there is a document dated 2020 related to additional compensation awarded to employees of the Fire Department and the Police Department.
In the proof file that ALPHV has labeled “Finance Scans 1 part” and uploaded to their website within the Tor network (68MB uncompressed), we also found a document related to the State Withholding Tax (SWT Report) for the period 1/1/2019 – 1/31/2019, containing the names and surnames of 44 municipal employees along with their Social Security numbers in plain text.
We do not know the amount of the ransom or when the ransomware group will publish additional documents from the municipal administration. In the past few hours, we have contacted the Chief of the Police Department and three out of the five members of the Town of Iowa Council via email for a statement on the case, but we have not received any responses at this time.
SuspectFile will update the article in case of new items