Father Bill’s & MainSpring targeted with ransomware attack

• Antivirus software used by the non-profit detected and blocked the ransomware attack in less than 30 seconds.
• An internal investigation conducted by the organization’s IT experts determined very minimal disruption and confirmed that it was safe to continue work.

Father Bill’s and MainSpring, a non-profit organization that provides shelter to the homeless, was recently targeted in an attempted ransomware attack.

What happened?

Father Bill's and MainSpring announced that it was attacked by ransomware on April 11, 2019. Antivirus software used by the non-profit detected and blocked the ransomware attack in less than 30 seconds. The ransomware did not encrypt or lock any files or computer systems.

“There was no exposure. We were able to restore all the files. We have no evidence to believe the files were compromised in any way,” said John Yazwinski, President & CEO of Father Bill's and MainSpring.

What is the impact?

Yazwinski said that upon discovery, they immediately disabled all access to data and shut down computer systems. However, an internal investigation conducted by the organization’s IT experts determined very minimal disruption and confirmed that it was safe to continue work. The staffs were able to continue their work without any disruption.

“We were able to disable all access to data and network drive. We definitely shut down the system as they went through and searched everything. There was minimal disruption,” Yazwinski said, Government Technology reported.

The response

• The non-profit organization reported the incident to the office of Massachusetts Attorney General Maura Healey.
• The nonprofit also published a legal notice about the incident and notified the individuals for whose private information including Social Security numbers were stored in the system.

“While there is no evidence of data theft, in accordance with Massachusetts state law M.G.L. c. 93H, the Agency mailed notification letters to individuals with known addresses whose private information (i.e. name, Social Security number) was in the Agency’s system. Addresses were unknown for 30% of the individuals,” Father Bill’s and MainSpring said.