Sammamish cancels all city credit cards as FBI investigates ransomware attack

SAMMAMISH, Wash. — The King County Sheriff’s Office said the FBI is now investigating a ransomware attack on the City of Sammamish that was first announced Wednesday.

On Thursday, Sammamish said it planned to cancel all city credit cards as a precautionary measure but couldn’t yet say if the personal information of residents, employees or those who do business with the city had been compromised in the cyberattack.

KIRO 7 asked Sammamish Mayor Christie Malchow if the city planned to pay the hackers now holding city computer files and systems ransom.

“The suggestion is that you don't pay it because there's not a guarantee that you'll ever get your data back,” said Malchow.

Malchow did not say how much the city has been asked to pay.

“Certainly, there’s a financial concern for the city,” said Malchow. “There is the concern for the data breach in general that our system is not adequate to prevent this from happening, and then of course the ability of the city staff to work has been impeded.”

KIRO 7 saw several people walking into city hall Thursday evening with work bags who would neither deny or confirm they were there in response to the ransomware attack.

"I don't think when you first learn about it that you understand the full breadth of it,” said Malchow. “And here we are on day two and we haven't made too much head way yet."

Permit processing, passports and pet licenses have been put on hold, according to the city, whose employees used pen and paper Thursday to conduct business inside city hall.

“The city has contracted with LMG security to assist with recovery; they were recommended to us by the City of Issaquah,” said the City of Sammamish in a Facebook post. “They have been working remotely on the issue overnight and will have a team onsite later today.”

KIRO 7 learned the City of Issaquah has proactively budgeted $200,000 this year to help better protect its city from cyberattacks. That money will be spent on hiring a new cybersecurity position, training and monthly network testing.

Issaquah said it has not had a cyberattack with a successful data breach.

"Moving forward, I think we'll have a very different view of our IT department and what we need to do for security to bolster that,” said Malchow.

In recent years, the FBI said ransomware attacks have become more sophisticated.

Yarrow Point said the town lost $25,000 in "uninsured expenses" related to a 2017 cyberattack on its computing systems.

Sammamish said it’s still working to figure out what it'll take to release city data and continues to assess which systems, beyond internal shared files, have been affected.

Cox Media Group