But city officials, who held a media briefing on the crisis late Thursday, said the price tag for the response is likely to be substantial. And despite dozens of volunteers onsite to assist in the recovery, only about a tenth of the city's computers have been repaired so far.
Mayor LaToya Cantrell told WWL-TV that she expected the cost of the attack would exceed the $3 million cyber insurance policy the city has in place, and that she will seek to increase the policy to $10 million next year. She did not discuss the insurance policy at the briefing.
"This is a very large task ahead of us," Cantrell said. "In terms of a dollar amount, that’s still really in the works as we determine the computers or equipment that will be pulled offline indefinitely."
As of Wednesday night, only about 10% of the city's 450 servers and more than 3,500 laptops had been re-imaged, Chief Information Officer Kim LaGrue said.
About 35 Louisiana National Guard personnel are working on the project, assisted by representatives of about 20 "industry partners," said Lt. Col. Stephen Durel. More assistance is expected over the weekend, he said.
"The process is slow because we’re trying to make sure there are no more infected machines on the network," Durel said. Those working on the project are also making upgrades to the system to make it less vulnerable to attacks in the future.
The goal, city officials said, is not only to get the system restored as fast and as safely as possible, but also to put New Orleans' cyber network in a better, more resilient position than it was.
“We’re building a totally new environment with significant upgrades to make us more sustainable in the future,” Cantrell said.
A priority for the administration is getting critical systems up and running in time for the holidays and then the Carnival season. The city is also focusing on getting access to its financial systems, which are cloud-based, so it can continue to pay employees and contractors.
City officials believe the attack began when an employee clicked on a link in a "phishing" email and provided their credentials. The city's Information Technology Department became aware of the attack early Dec. 13 when a large volume of such emails began showing up in the system.
Officials have also detected the presence of ransomware, which is malicious software that locks up computers or encrypts data and demands payment to allow access.
No city data were lost in the attack and no demands for payment have been made, Cantrell said.
"This could have been much worse than what we are now," she said.
Critical public services like 911 were not affected and the police, fire and EMS departments have continued to operate. In the meantime, however, other city departments have been working with pen and paper or from personal computers, and Municipal and Traffic Court has canceled all hearings and trials through the end of the year.
A scaled-down version of the city's website, nola.gov, was running on Thursday with basic information on what services are up and running and what alternatives are available for those that aren't.
Durel said the process to restore the network would normally take several weeks to several months to complete, but the city is working on a much faster schedule.
The attack followed similar episodes in other major cities, including Baltimore and Atlanta, as well as a recent one targeting Louisiana's state government. The city's response is largely based on the state's experience.
Outside cybersecurity experts said earlier this week that they believe those behind both the city and the state attacks likely used Ryuk, a piece of malware that was first discovered about 16 months ago and is popular with criminal organizations in eastern Europe and Russia.
Whether the two attacks were caused by the same software is still under investigation, Durel said.
“It is similar but we cannot confirm whether it’s the exact same strain,” he said.
Investigators are also still looking into where the attack originated.
©2019 NOLA Media Group, New Orleans. Distributed by Tribune Content Agency, LLC.
