State AG’s office investigating ransom attack that knocked out website, email and phone service

Attorney General Dave Sunday said his office is continuing to recover from the attack, which also took down the office’s website. He said it was caused by a person outside the agency encrypting files in an attempt to force the office to pay to recover the data. 

The state Attorney General’s Office is investigating a ransomware attack that interrupted email and phone service for the agency nearly two weeks ago.

Attorney General Dave Sunday said in a statement Friday his office is continuing to recover from the attack, which also took down the office’s website. He said it was caused by a person outside the agency encrypting files in an attempt to force the office to pay to recover the data. 

No payment was made, according to the statement.

“This situation has certainly tested OAG staff and prompted some modifications to our typical routines — however, we are committed to our duty and mission to protect and represent Pennsylvanians, and are confident that mission is being fulfilled,” Sunday said.

Citing an active investigation involving other agencies, the Attorney General’s Office said it was unable to comment further on the recovery process or the incident. It noted it would provide additional updates and would contact people individually if necessary.

The office is the commonwealth’s top law enforcement agency responsible for enforcing state laws, investigating and prosecuting crimes and consumer protection. It receives and investigates complaints from the public ranging from price gouging to financial fraud.

Since the attack, which the office first announced Aug. 18, email access has been restored to the majority of staff. The Attorney General’s Office main phone line and website are online.

The office employs about 1,200 people in 17 offices across the commonwealth. Sunday said they are performing their duties, “albeit parts of their work is being done via alternate channels and methods.”

“You can judge the character of an organization by how it reacts to adversity. I am very proud of our staff who continue to work and find ways to overcome these unexpected hurdles fulfill our duty to the commonwealth,” he said. 

In response to the interruption, some courts have issued orders providing time extensions in criminal and civil cases, the statement said. It notes that continuances are routinely requested by prosecutors and defendants as part of the normal course of business in the courts.

“However, we do not expect — based on what the investigation has revealed so far — that any criminal prosecutions will be negatively impacted solely due to the outside interruption,” the statement said.

“Attorneys have been going to court and agents have been performing investigative tasks over the past three weeks, including multiple public safety initiatives for which we expect to make public announcements in the near future,” the office said.