Vulnerability found in Grand Forks County email server, prompting a temporary shutdown

On Thursday, county employees started reverting to a backup of their email server after North Dakota’s statewide IT division informed them that they had a probably critical vulnerability. The county shares a Microsoft Exchange email server with a number of different municipalities, and Microsoft claimed that Chinese hackers had found and exploited a vulnerability in that software program. County employees anticipate their email service might be offline till early subsequent week.

The extent of the issue has been offered in basically two methods by county directors. Dean Dahl, the county’s IT director, despatched a mass email to county workers on Thursday afternoon warning that “the Chinese have hacked our Email server” and that the county’s email service could be shut off till tech employees may construct one other server from backups, and a second email from a “no-reply” handle introduced the identical and pegged it to “being hacked by a international nation.” Sheriff Andy Schneider’s workplace introduced to the general public at massive that an unnamed nation “has hacked our email server.”

But that basic account doesn’t sq. with subsequent interviews with Tom Ford, the county’s head administrator, or a followup message from Dahl.

Microsoft introduced Tuesday that it had found a number of exploits that had been getting used to assault sure variations of its Exchange software program. Those digital attackers had been capable of entry email accounts and set up malware, the corporate stated.

“Microsoft Threat Intelligence Center (MSTIC) attributes this marketing campaign with excessive confidence to HAFNIUM, a group assessed to be state-sponsored and working out of China, based mostly on noticed victimology, techniques and procedures,” company staff wrote on Tuesday. Hafnium is “extremely expert and complex,” and it primarily targets infectious illness researchers, regulation companies, larger training establishments, protection contractors, and coverage suppose tanks, according to Tom Burt, a Microsoft vice chairman.

But, in accordance with Ford, the county doesn’t imagine that hackers from Hafnium or wherever else accessed Grand Forks County emails. The server the county makes use of and shares with different North Dakota governments has the identical vulnerability as servers which were hacked, nonetheless, which is why the county hit the brakes and is reverting to an earlier model.

“This is a precaution,” Ford stated. “We’ve been recognized as susceptible, so we’re simply shutting it down, scrapping it, and rebuilding a new one simply to be secure.”

Dahl on Friday informed the Herald that “nothing unfavourable has occurred” however the county is nonetheless taking preventive motion. He didn’t instantly reply when requested through textual content message concerning the email claiming the Chinese had hacked the county’s email server.

Ford in contrast the preliminary messages about the issue to a recreation of “phone,” in which a message is step by step distorted because it strikes from individual to individual.

Kevin Ford, the chief info safety officer at North Dakota’s statewide IT division, didn’t return an emailed request for remark, and employees there stated they don’t seem to be allowed to reveal his workplace line or switch callers to him.