Breach Report: City of Dallas Royal ransomware report pending

Pending investigation and update from the City of Dallas

One-sentence summary:

The City of Dallas was attacked by the Royal ransomware group in May 2023, affecting hundreds of city and police department IT systems.

Who was involved?

The City of Dallas and its services, including the Dallas Police Department, Dallas Fire Department, the Dallas Public Library system, Dallas Court & Detention Services, and the Royal ransomware group.

What was the timeline?

May 3, 2023: The City of Dallas detects the ransomware attack and begins its incident response

What occurred?

The City of Dallas detected a ransomware attack in progress early morning on Wednesday, May 3, 2023, conducted by the Royal ransomware group (Lyngaas, 2023; Abrams, 2023). City and police IT systems and online services are affected, including the police department’s and fire department’s websites, which are experiencing a complete outage either from compromise or the incident response (Lyngaas, 2023; Brown, 2023). The Dallas online municipal court system is down, and jury trials have been canceled (Brown, 2023). The Dallas Police Department is currently taking calls via its existing radio system instead of via computer (Brown, 2023). Ransom notes have been reported to have been printed by the Royal ransomware group with the city’s printers (Abrams, 2023). The investigation is still in progress, and the results will be completed here.

Estimated costs:

Incident response costs, operational costs due to outages of IT infrastructure

Involved laws:

Pending

Root cause:

TBA or N/A (see disclaimer)

Lessons learned:

TBA or N/A (see disclaimer)

Sources:

Abrams, L. (2023, May 3). City of Dallas hit by Royal ransomware attack impacting IT services. BleepingComputer. https://www.bleepingcomputer.com/news/security/city-of-dallas-hit-by-royal-ransomware-attack-impacting-it-services/

Brown, L. (2023, May 4). City of Dallas impacted by ransomware attack, police computer dispatch system down. FOX 4 News Dallas-Fort Worth. https://www.fox4news.com/news/city-of-dallas-hit-with-ransomware-attack

CBS Texas. (2023, May 3). Ransomware attack hampering Dallas police operations. CBS News. https://www.cbsnews.com/texas/news/possible-cyber-attack-hampering-dallas-police-operations/

City of Dallas (dmagstatic.com). (2015, August). dcvb-logo.jpg. dmagstatic.com. https://assets.dmagstatic.com/wp-content/uploads/2015/08/dcvb-logo.jpg

Lyngaas, S. (2023, May 3). Ransomware attack on City of Dallas knocks police website offline. CNN. https://www.cnn.com/2023/05/03/politics/ransomware-dallas-police-department/index.html

About Post Author

Kyler Kent CISSP

Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike’s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation—turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master’s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect – Professional, AWS Security – Specialty, and multiple CrowdStrike credentials. He writes to close the gap between “what the textbook says” and what analysts actually do on shift with his published book: "SOC Analyst Career Guide" (ISBN-13: 9781835467466). https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com