USVI Public Records

Document text

Good afternoon, Senator Avery Lewis, Chairman of the Committee on Government Operations, Veteran’s Affairs, & Consumer Protection, other members of the committee, and non committee members present. My name is Raymond J. Williams, Executive Director of the Virgin Islands Lottery. Along with me today is Deputy Executive Director, Ms. Shalyn Proctor. We were invited to provide an update on the operations of the Virgin Islands Lottery and primarily to report on the recent Cybersecurity attack on our Information Technology systems, our challenges, and plan of action moving forward. We cannot provide specific details here today as we do not want to provide information publicly that can give any bad actor(s) the opportunity to access our systems yet again or to compromise ongoing federal investigations. The chronological background is that tickets for draw number 1048 had begun sales on St. Croix for two days on March 13 and 14, and on St. Thomas half day on the14th. On March 12th, St. Thomas experienced an environmental air quality event in resulted in the shuttering of that districts’ office. Sales resumed on March 14th. On the morning of March 17, 2025, upon arrival at the offices in both districts, our I.T. staff recognized that our systems were not operational and proceeded to make attempts at rebooting them. Not having any success, we reached out to our consultant-Smartpoint Inc.-who also attempted to reboot our systems remotely to no avail. Smartpoint immediately travelled to St. Croix to further evaluate the situation that same afternoon. Within a short period of their arrival and an evaluation of the servers and systems, the reality of a ransomware attack was identified Territory-wide. There was a ransom note found that basically said, if we wanted our encrypted information back they would return same for a fee of $1 million dollars. They would provide us with details on how to recover our data within a very short period of time. Our entire system had been encrypted, making it literally impossible for us to operate. Unlike a similar attack more than a year ago where our system was attacked on St. Thomas, but we had backed up information stored on St. Croix, this time the bad actor(s) were able to infiltrate our entire system (phones, computers, servers and software, etc.) in both districts. After immediate discussions with our consultants and the Virgin Islands Bureau of Information Technology (BIT), we decided to move forward with: 1. Identifying the equipment that was encrypted; 2. Initiating a case with CISA via BIT to get immediate technological support; 3. Starting a case file for the investigation of what, who, where and when; 4. Attempting to recovery our data; and 5. Beginning a path forward in reestablishing our IT systems. We recognized that the “bad actor” had basically “put us out of business!” Our IT team (consultants, BIT and our staff) started implementing steps at identifying ‘patient zero’ a technical term used to describe the origination of the infected equipment and isolating the actors and equipment physically. Attempts were made to recapture the encrypted information via various technology to no avail. Our immediate next steps were to utilize our backed-up files to recreate our systems. Most of the information wasn’t available so we literally found ourselves having to rebuild an entire system from scratch. Over the next few weeks, we had all our servers, computers and other systems sanitized, loaded with new security measures, and then we began the arduous process of rebuilding. The majority of our staff became computer data entry clerks. We spent almost 10 hours each day re-entering information from hard copies of sales receipts, prize payments, and other information going back to drawing number 1027 (February 2024) to draw number 1046 (February 2025). Our stellar staff performed this herculean task without fail. We worked weekends and holidays. We provided meals for several weeks to ensure that we kept our team focused on the task of getting back up and running. This process in rebuilding has been and continues to require more work as we want to bring the “The Wave of Opportunity” back to it’s full potential. It took us approximately seven weeks to be able to host our first drawing since the cyberattack. On Monday, April 28, 2025, we were finally able to host draw number 1047. Tickets for draw 1047 sales were completed and meant to be drawn on March 13th. To ensure that none of the tickets for previous draws that would have expired within 180 days, we extended the expiration date to be equal to the amount of days the office was shuttered. We kept all our customers, dealers, and our community informed as the weeks went by. We are grateful for the support from our community as we worked long days and weekends to bring us back to operational status. I want to emphasize several lessons learned throughout this entire experience and share with everyone within the sound of my voice today. 1. Any individual, entity or organization is susceptible to a cyberattack. 2. Bad actors don’t sleep and are forever looking for opportunities to infiltrate and encrypt hardware, software, or any other critical infrastructure that exposes a weakness. 3. In organizations such as ours and the private and public sector, events like these will continue to happen even if you follow the strictest of protocols. 4. We have learned that ensuring multiple back-ups of all your systems, to include having Multifactor authentication along with multiple forms of security are the backbone to preventing these attacks. 5. Training, training, and more training is one of the guiding principles to ensuring everyone on our staff is competent enough to know and understand that “phishing” expeditions are always lurking everywhere and awaiting an opportunity. 6. Investing in technologies that will continuously monitor your daily work and blocking out chances for them to enter is always a must. We were able to restore our financial platforms and software such that we could start paying our vendors, staff, and other mandatory transfers within a short period of time. At no time were our bank accounts susceptible to this attack. Subsequently, we continued to rebuild our Point of Sales, Print on Demand, and all the other software systems we require to operate. There still remains work to be done but we are now able to operate. Path Forward The VIL has several vacancies within our operation that we are currently working to fill. Those positions include our I.T. Director, Marketing Director, Marketing Specialist, and Chief Enforcement officer to name a few. We have been challenged in recruiting persons who have stellar qualifications for some of these positions due to salary requirements. We have reached out to our Commission and plan to address some of these variances in our FY ’26 budget cycle. As recommended, we will be migrating to the BIT platform as another resource in ensuring more resilient and secure systems. Although we have multiple challenges ahead of us, we remain steadfast in our goals to Rebuild, Fortify, and Ensure Resiliency. I once again take this opportunity to thank our awesome staff for their contributions in rebuilding the VIL. I thank our Commission for their understanding and support. Senators, this presentation may not be as detailed as you may want but always remember that an ounce of caution prevents a pound of cure. We stand ready to answer your questions.