P2021-ND-183

On June 13, 2020, the Organization began to experience system outages. An investigation revealed that two servers had been encrypted by ransomware. The Organization did not pay the ransom and reported the incident to the authorities. The Organization restored the servers from backup copies. The Organization reported that it does not have any evidence or direct indication that sensitive data was copied (exfiltrated) in addition to being encrypted, but said it cannot rule out the copying of data.p The Organization also reported that while there was encryption of data and a request for ransom, its investigation determined that there is no evidence that any information was accessed in this incident.