Atlanta’s network almost recovered from cyber attack, cost still unknown


The City of Atlanta’s computer network has nearly recovered from a ransomware cyber attack suffered nearly two months ago, said Chief Operating Officer Richard Cox in an Friday interview with The Atlanta Journal-Constitution and Channel 2 Action News.

Cox said the municipal court is the only department whose computers haven’t been brought back online.

“We are in testing right now,” Cox said, adding that he expects them to be operational in about 10 days.

Cox said the total cost of the attack has yet to be calculated. But emergency contracts posted on the city’s procurement website have a combined not-to-exceed amount of about $5 million.

“If you dig into those numbers a lot of those expenses are inevitably things we were going to have to invest in regardless,” Cox said.

On March 22, city employees were ordered to turn off their computers to stop a virus from spreading through the network and encrypting data. A cyber criminal group demanded that the city pay it about $51,000 in bitcoins — a crypto currency that allows for anonymous transactions online.

The city refused to pay the ransom on the advice of federal agents.

“We were advised, at some point during the attack, this particular threat actor had hit places after the ransom was paid,” Cox said.

Following the attack, the city hired Secureworks, a Dell subsidiary, who has emerged as an early authority on the cyber-criminal group, “Gold Lowell.” That group is being blamed for a rash of cyber attacks involving a variant of SamSam, the type of ransomware that struck Atlanta.

In early 2018, about a month before the Atlanta cyber attack, Secureworks published a report titled “SamSam Ransomware Campaigns,” which noted that the recent attacks involving SamSam have been opportunistic, lucrative and impacted a wide range of organizations.

Cox said on Friday it was too soon to say if any data or other records had been permanently lost.

“We are still in the process of going through files to understand the status,” he said. “That process will continue to take quite a while.”

The city provided a copy of its cyber attack insurance policy to the AJC this week in response to a public records request, but redacted the coverage limits, citing security concerns.

Cyber attack insurance policies are an uncharted area of the market, and security experts have warned that the risks associated with them are difficult to calculate. The policies contain a number of exclusions and require meeting basic security standards.

Asked if he expected an insurance payout, Cox said: “We are having ongoing conversations with our cyber insurance vendor … Our expectation is that we will be able to partner with them in a very fair manner.”



Reader Comments ...


Next Up in Local

SUNDAY’S WEATHER-TRAFFIC: Drier, hotter weather pattern shifts into North Georgia
SUNDAY’S WEATHER-TRAFFIC: Drier, hotter weather pattern shifts into North Georgia

Sunday: High: 91 Sunday night: Low: 74 Monday: High: 94 Atlanta and North Georgia will get a much-needed break from the past few days of severe storms, Channel 2 Action News reported. The cold front pushing this moisture and thunderstorms into Georgia has moved past us, meaning clearer skies. That also means it’ll be hotter. "...
Police chase ends in wreck; 5 taken to Atlanta hospitals, including 3 kids
Police chase ends in wreck; 5 taken to Atlanta hospitals, including 3 kids

A vehicle fleeing Georgia State Patrol pursuit ended up wrecking into two other vehicles Friday night, sending five people to Atlanta hospitals, GSP confirmed. A trooper noticed a white Hyundai allegedly speeding and weaving on I-75 South near Northside Drive and attempted to stop the vehicle, according to a GSP news release. The Hyundai allegedly...
Man fatally shot in NW Atlanta, police confirm
Man fatally shot in NW Atlanta, police confirm

A man was fatally shot in Atlanta early Saturday morning, Atlanta police confirmed. Officers responded to a shooting at 2:30 a.m. at 62 Harwell Road in northwest Atlanta and found a 31-year-old man dead outside of one of the buildings there, Atlanta police said. Atlanta police are investigating the incident, and they haven’t determined the circumstances...
Small earthquake registered in Middle Georgia near Macon
Small earthquake registered in Middle Georgia near Macon

A small earthquake occurred near Macon Saturday morning, according to the U.S. Geological Survey. The 2.4 magnitude quake was reported in Jones County near Gray, which is about 90 miles southeast of Atlanta. It’s less than 15 miles from Macon. It was reported at 9:55 a.m. There haven’t been any reports yet of anyone feeling shaking from...
GBI identifies son who allegedly shot his mother before 3-hour SWAT standoff
GBI identifies son who allegedly shot his mother before 3-hour SWAT standoff

The identity of the man who allegedly shot his mother in Jackson County Friday, prompting a 3-hour SWAT standoff, has been released by the GBI during their initial investigation report into the incident. Jonathan Wayne Allen, 37, of Jackson County, has been charged with aggravated assault after he surrendered to the Hall County Sheriff’s Office...
More Stories