DURHAM, N.C. (WNCN) – The malware used in two separate malware attacks on the networks of the City and County of Durham have been contained, city officials said.

City Manager Tom Bonfield said the city’s entire network was affected by the malware attack – which occurred Friday evening – but no personally identifiable information was lost in the breach.

Durham technology officials said someone opened an email attachment which allowed the malware on both servers.

“This particular virus is prolific,” Bonfield said.

While Bonfield described the attack as a “serious incident,” he did not believe the Durham networks were targeted.

The city manager confirmed a forensic investigation is underway.

Kerry Goode, director of the Technology Solutions Management Team, said the RYUK virus was used in the attack which he described as a “premier malware virus.”

“We have planned for this day to occur,” Goode said.

The city’s plan brought together a team of professionals to respond to the attack which was able to contain the virus by turning off the networks.

He believes the data center will be restored in two days.

The city has identified five workstations where the virus entered the city’s network. On the county’s side, one laptop has been identified in the investigation.

When asked if any voter registration information was affected, officials said there was “no indication” that any data was tampered with amid the attack.

Goode said RYUK has forced users to hand over billions in ransom in the past.

Currently, both the city and county are in recovery mode and they are taking steps to make sure all systems are cleared of the malware.

“We quickly identified a tool that can catch the virus and eradicate it and we put it on the work stations as an added precaution,” Goode said.

Officials said they are working to get the computer and phone systems back up and running for the crucial services — such as public health and social services– as soon as possible.

Officials said it will likely be one to two weeks before everything is back to normal for both the city and the county.

Right now customers can go to pay their city water bill, but the staff can only take cash payments. Customers can go online and pay at durhamnc.gov or call 844-592-4918. Officials said it is likely billing for some districts will be delayed as a result of the issue.

Both city and county officials said they have a plan and they are prepared if this happens again.



“This is not rare, this is common,” said Mayor Steve Schewel. “The way I think we need to view this is not if this is going to happen, but when it is going to happen. And we are prepared.”

Both city and county officials said they are do educate their employees about possible cyber attacks on a regular basis.

When CBS 17 asked why they waited two days to notify the public about the attack, they said they needed to make sure all of the information was accurate before they put it out to the public.