Modesto shuts down email after malware attack

About a dozen city workers got a lesson in cybersecurity Tuesday after they opened a malicious email, causing Modesto to take down its email system for a few hours as it resolved the threat.

Modesto officials said the malware did not cause problems, and they are working with the city’s antivirus vendor – the security firm McAfee. Officials said they believe this was a random attack and the email was designed to collect information, such as user names and passwords.

Information Technology Manager Kevin Harless said there is no indication any data left the city. He said this was a medium-level problem and it has been about eight years since the city was last hit by a virus of this magnitude. “It could have turned into something worse,” he said. “Our quick response kept it from becoming a larger issue.”

Administrative Services Director Joe Lopez said the email breached the city’s safeguards because it “was the latest and greatest” version of malware.

Harless said IT staff spotted the suspicious emails coming into the city about 7:30 a.m. Within minutes, staff members emailed city employees not to open the email and to delete it if they received it. But officials believe about a dozen employees already had opened the email and its attachment.

Officials said the email’s subject line was “Payment from Chase Ban,” with the letter “k” missing. Officials said the email instructed readers to click on the attachment to learn more about how they could collect $17,000.

That created the problem. A program within the attachment then sent the malicious email to all of the readers’ contacts. Officials said it reached the city’s 900 to 1,000 workers with email. They said they don’t believe the email went to anyone beyond city workers, and they notified Stanislaus County officials as a precaution.

The city shut down its email from about 8:30 to 10:45 a.m. as it resolved the problem. It kept the email for the Police Department down until about noon as an extra safeguard. The Fire Department has its own email system and was not affected by the malware.

This story was originally published January 13, 2015 at 7:43 PM with the headline "Modesto shuts down email after malware attack."