Dallas Releases Preliminary Report Following Ransomware Attack

On May 3, the city of Dallas experienced widespread network outages due to a ransomware attack by a group called Royal.

Since then, the city’s IT department has focused on getting all affected services and systems back online.

“At this time, we are more than 90 percent restored, with most public-facing services restored,” reads a June press release from the city.

In terms of what still needs to be fixed, the city recently published a technology accountability report (TAR) detailing preliminary findings.

“Between the impact of the attack and from removing systems and services from the network in an effort to contain the spread of malware, there were broad impacts to the city in delivering services,” the report reads.

In an immediate response, city departments implemented backup plans and worked to deliver vital services to residents by reverting to manual processes.

As of May 31, the city is still undergoing recovery operations to restore services to a pre-attack level. At the same time, an ongoing criminal investigation into the Royal group is taking place.

As a result, only information that can be released publicly is included in the report. Once the criminal investigation is complete, an after-action report (AAR) will be published, along with a plan of actions and milestones (POAM) addressing findings from the attack.

As for how the city’s IT operations were affected, the TAR highlighted the following:

• In May 2023, the city’s IT help desk received 11,740 calls for support, an increase of 4,450 over April's 7,319 calls. The yearly average is approximately 7,700 per month.
• May saw an increase in both the average time to repair and total outage time for major incidents compared to April.  
• May’s average “mean time to repair” (MTTR) was 544 hours compared to April, which was 42.1 hours.
• May’s total outage time was 3,268 hours compared to April’s 715 hours. 
• In total, the city experienced eight major incidents, five critical and three high, during the month of May.
• Field services (excluding the police department) average service duration totaled 4.7 days in May, compared to 3.4 days in April. 
• Field services for Dallas Police Department (DPD) saw a similar increase in average service duration of 3.8 days in May from 2.7 days in April.