A cyberattack on the Office of the Colorado State Public Defender forced the agency to shut down its computer network, locking public defenders across the state out of critical work systems and prompting attorneys to seek delays in their court cases.

Office spokesman James Karbach confirmed the breach in a statement Monday, saying officials “recently became aware that some data within our computer system was encrypted by malware.”

Karbach did not say how long the public defender’s office expects to be shut down or when the attack happened, but internal emails reviewed by The Denver Post indicate the statewide office is effectively non-operational and the outage could last as long as a week.

Colorado public defenders do not have access to their work computers, are unable to access court dockets or court filings and can’t do any significant work for clients in court, according to emails sent to the office’s staff.

The “cybersecurity incident” was underway by about 11 a.m. Friday, according to an emailed notice sent from the Colorado Judicial Department’s Information and Technology Service’s to judges and judicial personnel. That notice indicated the cyberattack does not pose a threat to the wider court system.

“As a preventative measure, we temporarily disabled our computer network and are working to safely and securely bring systems back online,” Karbach said. “Our operations will be limited while the network is offline.”

In court Monday morning, public defenders asked to postpone hearings again and again.

“Given the malware with the state public defender, I can’t access my files,” public defender Amanda Miller said in Adams County District Court as she asked to push a hearing back for a month.

“I’m not allowed to use my computer,” public defender Jennifer Chu said in the same courtroom a few minutes later as she asked to postpone a sentencing.

“I feel like we are going to be doing a lot of this this week,” Adams County District Court Judge Jeffrey Smith told Chu. “Let’s get you a new date.”

The judge later warned another defendant that the public defender’s system outage was expected to last a week.

The wider court system is “fully operational,” Colorado Judicial Department spokesman Rob McCallum said Monday.

“Our systems are not impacted by the Public Defender’s system breach,” he said in a statement. “…As always, we are monitoring our network for any anomalies.”

Ransomware attacks are common

The limited information that officials have put out about the cyberattack on the public defender’s office suggests the agency was hacked with ransomware, said Steve Beaty, chair of the computer sciences department at Metropolitan State University of Denver, though he cautioned that he is not involved with the incident.

Ransomware attacks are common, he said. In the last few years in Colorado, such attacks have targeted Regis University, the cities of Lafayette and Wheat Ridge, the Colorado Department of Transportation and others.

Attackers use malware to hold an organization’s data hostage, Beaty said, then demand a payment in cryptocurrency in order for organizations to regain access to that data. Both public agencies and private businesses have been targeted in a steady stream of ransomware attacks since about 2013, he said.

“It’s a crime that essentially is relatively easy, in the grand scheme of things, to get away with,” Beaty said.

About half of victimized organizations pay the ransom, Beaty said. The city of Lafayette forked over $45,000 to ransomware attackers in 2020, and Regis University paid an undisclosed amount of ransom that same year. Wheat Ridge and the Colorado Department of Transportation did not pay their attackers, but spent $1.5 million restoring their systems in 2018.

Whether targeted companies pay depends on the scale of the attack, the company’s insurance and the quality of backed-up data, Beaty said. The ransomware attackers often steal a target’s financial data first, and know exactly how much a company is likely to pay to retrieve the lost data, he added.

“Essentially it is less expensive to pay the ransomware than to try to bring back all the data from backups,” Beaty said.

Ransomware was used in 24% of cybersecurity incidents in which data was disclosed to an unauthorized third party between November 2021 and October 2022, according to Verizon’s 2023 Data Breach Investigations Report.

Nearly 500 data breaches involving Coloradans’ personal information were reported to the Colorado Attorney General’s Office between Jan. 1, 2022, and Nov. 29, 2023, a list that includes businesses, governments and institutions in this state and elsewhere across the U.S.

The malware that powers the cyberattacks is typically delivered into a system either when a person clicks a bad link, often in an emailed phishing attempt, or by exploiting a software bug, Beaty said.

“Very few organizations are immune to this…The most important thing is to keep your systems up to date, keep them patched, make sure the known exploits are being fixed, that your firewalls are up to date, that your software on devices is up to date,” he said, adding that quality backups are also essential. “So that when — not if — when we are attacked, we have the ability of going back and starting fresh a day ago, an hour ago, a week ago.”

Targeting government agencies

Ransomware attacks are increasingly aimed at government agencies, said Mark Weatherford, who is on the board of directors at the National Cybersecurity Center, a Colorado Springs nonprofit.

“It’s definitely something that is concerning to us,” he said. “I often say you can choose which grocery store to go to, but you can’t choose which government you deal with… it’s a higher bar for the government to protect our information than for a public company.”

He added that a current trend within ransomware attacks is that even if an organization pays the ransom and receives access to their data, the attackers will keep a copy of that information and then threaten to expose that data publicly unless a second ransom is paid.

“That is what my fear would be here with the public defender’s office. You can just imagine what kind of data the criminals may have downloaded with respect to the people and the cases the public defender’s office is working on,” Weatherford said. “The privacy and sensitive information of all their clients is what I would be most concerned about right now.”

Get more Colorado news by signing up for our daily Your Morning Dozen email newsletter.