Wichita LockBit Ransomware Attack: A 2-Year Retrospective and What Every Wichita Business Should Learn

Editor’s note: On May 5, 2024, the City of Wichita’s IT systems went dark. Utility billing, municipal courts, public transportation payments, and police records all went offline simultaneously. The LockBit ransomware group claimed responsibility within 48 hours and posted a ransom deadline of May 14. The city did not pay. The cleanup is still influencing how Wichita-area businesses think about cyber resilience two years later.

This is a forensic-style retrospective from the perspective of a Wichita-based incident response firm that has spent 21 years in this market. We were not retained by the city, but we have worked the same threat actors on private sector engagements, and the lessons translate. If you run a business in Sedgwick County or anywhere across Kansas, the same gaps that brought down Wichita’s systems almost certainly exist in your environment too. This article walks through what happened, what should have stopped it, and what every leader needs to verify this quarter.

What happened on May 5

The City of Wichita first disclosed the incident on Sunday May 5, 2024 as “an IT issue” affecting payment systems. Within 24 hours it was reclassified as a ransomware attack. The city took the unusual step of pulling systems offline preemptively, which limited spread but also took down services that residents depend on every day:

• Water and utility billing
• Municipal court proceedings and online payments
• Public transportation fare systems
• Cultural venue ticketing
• Some police record systems (though emergency response remained operational)

LockBit, a Russian-aligned ransomware-as-a-service group, claimed responsibility on May 7 and posted Wichita to its dark web “victims” page with a May 14 payment deadline. After the deadline passed without payment, the group claimed to have sold the exfiltrated data. The city has confirmed that personal information including Social Security numbers, driver’s license details, and payment information for some residents was exposed.

The recovery took weeks. Some systems were restored from backups in days. Others required complete rebuild. The full direct cost has not been publicly disclosed, but recovery from incidents of this scale typically runs $1M to $10M before accounting for legal exposure, credit monitoring, and lost productivity. Independent estimates put the Wichita incident toward the higher end of that range.

Who is LockBit, and why does it matter for Wichita

LockBit is not a hacking group in the traditional sense. It is a criminal franchise. The core LockBit operators build and maintain the ransomware encryptor, the leak site, and the negotiation infrastructure. Affiliates rent access to all of this, conduct the actual intrusions, and split the ransom roughly 80/20 with the core team. At its peak in 2023 and early 2024, LockBit was responsible for an estimated 25% to 40% of all named ransomware victims globally.

In February 2024, a coordinated international law enforcement operation (Operation Cronos) seized LockBit infrastructure and identified the alleged leader. The Wichita attack came barely two months later and is widely understood as evidence that LockBit affiliates continued operating despite the takedown. The lesson for defenders: do not assume that a high-profile law enforcement action shuts down the threat. Affiliates regroup under new brands within weeks.

For Wichita businesses, the takeaway is that LockBit-style operators specifically target organizations that:

• Have public-facing remote access infrastructure (VPN, RDP, RMM tools) with weak or absent multi-factor authentication
• Run unpatched edge devices (Citrix gateways, Fortinet, Ivanti VPNs, MOVEit, SonicWall)
• Have flat internal networks where one compromised endpoint can reach the domain controllers
• Have backups on the same network as production, reachable by administrative credentials
• Have not tested their incident response plan in the last 12 months

Almost every business we audit in the Wichita metro fails at least three of these tests. The city of Wichita was not uniquely vulnerable. It was unluckily public.

What should have stopped this

Post-incident reporting on the Wichita attack has not fully disclosed the initial access vector, and likely never will. But based on LockBit’s standard playbook and what we have seen across hundreds of private-sector recoveries, the chain almost certainly looked like this:

1. Initial access: Phishing email, exposed RDP, or exploitation of an unpatched edge device (the three most common LockBit entry methods).
2. Discovery and lateral movement: Attackers spent days or weeks mapping the environment, identifying domain controllers, file shares, and backup systems.
3. Privilege escalation: Theft of administrative credentials, likely via Mimikatz or similar credential dumping tools, often using legitimate built-in Windows utilities (“living off the land”) to avoid endpoint detection.
4. Backup destruction: Identification and encryption (or deletion) of backup systems first, ensuring no clean restore path. This is LockBit’s signature move.
5. Data exfiltration: Bulk download of sensitive data to attacker-controlled infrastructure, typically over 72 to 168 hours, for use as leverage in the ransom negotiation (“double extortion”).
6. Encryption and ransom note: Mass encryption of file systems across the environment, typically initiated at off-hours to maximize damage before detection.

The defensive controls that would have broken this chain are not exotic. They are the same five controls we recommend to every Wichita business we audit:

1. Phishing-resistant multi-factor authentication on every administrative and remote access account

SMS-based MFA and even authenticator-app MFA are now routinely bypassed by modern adversary-in-the-middle phishing kits. The only MFA that reliably defeats this is hardware-key based (FIDO2 / passkey / WebAuthn). Yes, it is more expensive. Yes, end users complain at first. It is also the single highest-leverage control against ransomware.

2. Immutable backups with separate administrative credentials

Backups must be unreachable from production administrative credentials. The standard implementations are Object Lock (S3-style WORM storage), tape rotated offline, or vault appliances with their own authentication realm. Beyond storage, the backup admin accounts must use different credentials than production domain admins. The Wichita attack and almost every major ransomware case we work share one feature: the backups were on the same domain as production.

3. Network segmentation with default-deny east-west traffic

One compromised workstation should not be able to reach the domain controllers, backup systems, or production servers directly. This requires segmentation at the VLAN and firewall level, not just at the host firewall. For most mid-market organizations this is a 60-day project with measurable cost savings even before considering ransomware risk reduction.

4. Endpoint detection and response monitored 24/7

Traditional antivirus catches known malware signatures. Modern ransomware is malware-free; it lives off built-in Windows tools (PowerShell, WMI, scheduled tasks). EDR tools watch behavior, not signatures, and are designed to catch credential dumping, lateral movement, and the suspicious file activity that precedes mass encryption. EDR without 24/7 human monitoring is theater. The attack windows we see most often span Friday night into a holiday weekend, specifically because attackers know defender attention is lowest then.

5. A tested incident response plan with named owners

The single biggest cost multiplier in a ransomware incident is the first 24 hours of confusion. Who calls counsel? Who calls the insurance carrier? Who has authority to shut down production systems to limit spread? Who briefs the executive team? If your answer to any of these is “we’ll figure it out,” you will lose an additional 48 to 72 hours during the worst week of your business’s life. We run a quarterly tabletop exercise for every retainer client for exactly this reason.

What Wichita business leaders should do this quarter

If you are reading this and feeling defensive, that’s normal. Every leader we talk to has a story about why their organization is “different” or “smaller” or “not a target.” The City of Wichita was not a target. It was discovered, scanned, and breached by automated tooling. Most of what affiliates do is opportunistic: scan, find the vulnerability, exploit, sell access. The decision to deploy ransomware comes later, sometimes weeks after initial access, based on the perceived value of the target.

Three actions this quarter, in priority order:

1. Verify your backups can actually restore. Not the existence of backups. The actual restoration of a production system into an isolated test environment. If you cannot publish the last clean-restore date by system, you are gambling.
2. Audit your administrative credentials. Every standing admin account is a target. Every legacy service account with high privileges is a target. Every workstation with cached domain admin credentials is a target. Aim to reduce standing privileged access to zero with just-in-time elevation tools.
3. Run a tabletop exercise with leadership. Two hours. Walk through what happens when ransomware is detected at 11pm on a Saturday. Identify the gaps in your decision-making chain. Fix them before they cost you a week of recovery.

If you want a second opinion

Ransom Security is a Wichita-headquartered incident response firm. We are part of the Click Techs family, which has served the Wichita business community since 2004. We have led one of the largest ransomware recoveries in our 21-year history, including a recent engagement involving a 26 BTC ransom demand and over $600,000 in direct recovery costs. We did not pay. The client did not lose data. The rebuild took months and informs everything we do today.

If you want a 30-minute conversation about where your organization stands, or a focused 12-hour readiness review against the controls in this article, call us at 316-712-4006 or take the free 2-minute Am I Safe assessment and a senior engineer will follow up within the business day.

If you are reading this in the middle of an active incident, do not wait. Call. The first 15 minutes matter more than the next 15 hours.

Sources: Security Magazine, May 2024; SecurityWeek; GovTech; Infosecurity Magazine; The Beacon News; KMUW; CISA #StopRansomware advisory for LockBit; Operation Cronos public statements (Feb 2024).