Hopkins Hack was 'Ransomware,' But City Still Weirdly Insists that no Ransom Demands Were Made

Valarie McCall is these days identifying herself as the city of Cleveland’s Chief of Communications, though she is still officially Mayor Frank Jackson’s Chief of Government and International Affairs. Monday morning, it was McCall who quarterbacked a press conference in Jackson’s absence to update the media on the recent cyberattack at Hopkins Airport.

McCall deflected aggressive questions from reporters who felt they’d been misled last week. She argued that while the city may not have provided everything reporters wanted with respect to downed computing systems and display screens at the airport, the city responsibly provided updates as they received them.

“There was never an intent to mislead the media,” she said. “I don’t know about you, but we’re not experts on this. Our timeline has been clear. Everything we knew we shared… There was no misleading. I don’t think it’s fair to say that.”

Local reporters had been told — and were told again Monday — that malware had been detected on airport computers Sunday, April 21. The malware brought down the flight information display, baggage information display and email systems. As of this morning, the displays were up and running and emails were slowly coming back online. McCall said that airport managers had been provided temporary email addresses.

An agent with the local FBI office — whose involvement the city initially denied — confirmed that they were initially contacted Sunday (4/21), met with the city the following Tuesday and have been analyzing the case ever since. They briefed city officials this morning and confirmed for the gathered media that “ransomware” had been detected in the system.

Ransomware is a specific type of malware in which access to internal systems is blocked until a ransom is paid. (Channel 19 reported last week that hackers had demanded bitcoin in ransom payment.) The city, however, had been denying that any ransoms were sought. In a press update last Friday, the city wrote in red letters that “no hacking occurred and no ransom demands [were] made.”


Wait, what?

Reporters Monday were all extremely confused. First of all, where was Mayor Jackson? (“He’s managing the situation,” McCall said. “He’s just not here today.) How on earth could the city be so out of touch? What did they mean when they said no ransom demands were made? Wasn’t that the whole point of ransomware?

No one speaking at the lectern made much sense. The city’s chief information officer Donald Phillips kept vaguely non-answering questions by saying that everyone at the city was “fighting the battle.” The FBI agent kept reminding folks that he couldn’t comment on the case specifically due to the ongoing investigation, but did manage to admit that in general, malware of this sort usually gets onto a system when a user clicks on a link and malicious software (malware) is downloaded.

McCall kept retreating from the lectern and then springing back to reiterate that no ransom demands were made. She volunteered the good news that "redundancies" had been installed to prevent a similar situation from happening again and alluded to forthcoming “legislative fixes.” She also attributed the lengthy delay in getting the display screens back online to a “New Zealand holiday.” Evidently, the airport’s screens are hosted by an overseas third-party vendor and festivities prevented prompt communication and repair. When a reporter inquired whether it was wise to have these systems managed overseas, no one could conjure up an answer.

In a telling moment, airport director Robert Kennedy said that all last week, at the airport, staff had been fighting to restore operations.

“All communications were funneled through City Hall Communications,” he said, wittingly or unwittingly alluding to the fact that ‘City Hall Communications’ is where communication goes to die.