Skip to content

Kansas City Scout cyberattack

Summary

Kansas City Scout System logo

An April 25, 2024, cyberattack forced KC Scout’s traffic cameras, highway message boards, website and app offline in the Kansas City area. Services returned in stages through early August; a Play ransomware claim remains distinct from official attribution.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
  • Incident end:
    ? Confirmed or defensibly assessed end of material operational disruption or incident activity.

Primary victim organization

Incident characteristics

Assessments

Attack mechanisms

  • Unknown cyber mechanism

    The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.

Data impacts

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Website unavailable

    A public-facing website was unavailable, disabled, or inaccessible.

  • Application unavailable

    A specific application or software platform became unavailable or unusable.

  • Transportation operations disrupted

    Transit, aviation, rail, maritime, logistics, fleet, traffic, ticketing, or related transportation operations were materially affected.

  • Third-party service disruption

    The incident materially affected services delivered by or through a vendor, managed service provider, contractor, partner, or other third party.

  • Downstream organization impact

    The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

Incident narrative

Analyst assessment

KC Scout shut down its traffic-management systems after an April 25, 2024, cyberattack. The jointly operated Missouri-Kansas service lost real-time traffic cameras, highway message boards, its website and app. MoDOT and KDOT acknowledged the attack, establishing cyber involvement and disruption to a shared transportation-information service.

Operational significance

Drivers lost Scout’s live traffic information, while emergency responders and media partners lost camera access. KCTV’s July 9 report described Johnson County emergency communications relying on callers and other location tools. This does not establish failed 911 calls or road closures.

Restoration occurred in stages. Message boards resumed June 20; the website returned July 9 with live camera views, while several other connections remained unavailable. Commission minutes for the Aug. 7 meeting report website and app camera views available by July 12 and the final media-camera connection restored the preceding Friday, Aug. 2. These milestones support resolved operational status without implying that every service returned simultaneously.

Confidence and uncertainty

Confidence in the cyberattack and extended outage is high. A ransomware.live listing associates KC Scout with Play, but this remains an attacker claim recorded by a tracker. It does not independently confirm the operator, encryption or stolen-data scope, and the discovery timestamp is not the claim’s publication date.

Analytic gaps

The initial access method, number of affected systems, any stolen information and ransom negotiations remain unresolved. The record does not establish a separate compromise of either Kansas City’s municipal network.

Threat actor and claim

Listed as: KC ScoutSource: ransomware.liveDiscovered:

Claim details

The tracker lists KC Scout under Play with kcscout.net. Its May 7, 2024 UTC discovery timestamp falls on May 6 in Eastern time and is not the original claim publication date. The listing does not independently confirm the attacker, encryption or stolen-data scope.

Organizations involved

Impacted locations

  • Jackson County, Missouri

    KC Scout’s affected traffic-management operation is based at 600 NE Colbern Road in Lee’s Summit, Jackson County. This is a physical-site anchor and does not mean Jackson County’s government network or the entire county was affected.

  • Kansas City, Missouri

    Kansas City anchors the bi-state KC Scout traffic-information service. It does not represent a Kansas City municipal-government outage.

  • Lee's Summit, Missouri

    Lee’s Summit contains KC Scout’s traffic-management center. This location anchors the affected transportation service.

Sources

KC Scout website, traffic cameras, message boards remain down after cyberattack

MoDOT said Scout remained unavailable after a protective shutdown, affecting traffic cameras, message boards and the website. Restoration work continued without a stated completion date.

Joint Statement from MoDOT and KDOT About KC Scout Services — KC Scout Website Restored

The website returned July 9 with live camera views, but app, traveler-map and media-camera connections still required work. The joint operators acknowledged the April 25 attack and ongoing restoration.

KC Scout — Play victim listing

The tracker lists KC Scout under Play and identifies kcscout.net. This is an uncorroborated attribution claim, without independently verified encryption or stolen-data scope.

Missouri Highways and Transportation Commission Aug. 7, 2024, minutes

The director reported an April 25 shutdown, June 20 message-board restoration, July 9 website return, camera views by July 12 and final media-stream reconnection on the Friday preceding the Aug. 7 meeting.

See something that needs correction?

Signed-in members can report an error, update, or missing source.