COLUMBUS, Ohio — It’s been over a month since cyber criminals targeted the city of Columbus, but when exactly did the attack begin?
City officials said it started in mid-July, but it could have started earlier.
Bret Hood, a retried FBI special agent said hackers could have been in the system in Columbus for a year or longer before the criminal acts began. He said the FBI can find out when the data was stolen.
The FBI can find that because there are internal records in the system that show date and time for when something was stolen. A representative for the mayor’s office told 10TV on Wednesday they do not have an exact date on when the hack started. Hood said one thing to look our for, is back doors that cyber criminals can take.
“The intent behind back doors is a way to get into the computer system without the owner knowing about it. Even if the owner knows about it, they’ve taken pre-cautions to plug up that one hole. The back door is a way to possibly still maintain access to that system without computer administration realizing its happening,” said Hood. “Even with the FBI investigating, there is a possibility that back door could exist. The FBI will scour the system, but it doesn’t mean we can catch everything."
10TV also spoke to Hood about how he thinks the FBI could be handling the investigation into the city of Columbus cyber-attack. He said first, the FBI gathers as much information as it can.
“Including information from the host computers. Once you get the information and you look through it you can see transfers, different data points, connections eithers from overseas or other servers, wherever they (the criminals) are at. It can be a long and tedious process,” Hood said.
Rhysida is the group claiming responsibility for the cyberattack in Columbus. They said they sold data, and posted some of the data on the dark web.
“Internet connections can bounce not only from state to state or city to city but also from country to country. So, if the FBI has to go to an overseas destination to retrieve information then that process can take at least a year until we can get court records needed to prove a case,” Hood said.
Hood said sometimes the FBI can get lucky, and quickly solve a case. But, that doesn't always happen. Sometimes, the FBI can’t take action on cases.
“The United States can always send a request to a country to take a certain action, extradite someone but there is no legal justification or reason to be legally bound to provide that person unless both countries enter an agreement,” he said.
10TV reached out to the mayor’s office. A spokesperson said Mayor Andrew Ginther is not available for an interview this because they have shared all verifiable information they can so far. Hood said his advice to the city, is to be transparent.
“I would be as open as I could, and provide as much info as I can without damaging victims we know there's cyber-attack and info stolen one of the ways develop trust with community is be open and accountable as actions as you can,” he said.
If you were affected by the cyberattack or have a news tip then email us at 10investigates@10tv.com.