9. Tillamook County, Ore.

Recovery And Mitigation Costs: $300,000

A Jan. 22 ransomware attack took down Tillamook County’s server, internal computer systems, website, phone systems and email networks, forcing the county to disable to computer network connection to contain the spread of malware, according to the Tillamook Headlight Herald. The attack originated from a group called REvil, which also goes by Sodinokibi or Sodin.

Commissioner Bill Baertlein said Tillamook County’s rapid and aggressive response to the incident mitigated the compromise and container the encryption to 17 of 55 servers and five of 280 county workstations. However, the cyberattack resulted in encrypted backups, meaning that data critical to county operations couldn’t be restored without paying the cyberattacker for decryption keys, he said.

It could have taken 12 to 24 months and cost $1 million to unlock the county’s computer system if the ransom went unpaid, Baertlein said at a March 11 Tillamook County Board of Commissioners meeting. As a result, county officials said a $300,000 ransom was paid to regain data access after the cyberattack, and county systems were operational by mid-March, the Tillamook Headlight Herald reported.