City of Atlanta Latest Ransomware Victim

The city of Atlanta is currently making headlines after a ransomware attack earlier this month crippled city services, demanding a $51,000 bitcoin ransom payment. The city’s Mayor Keisha Lance Bottoms warns all city residents, employees, and vendors maintain vigilance, fearing the malware will spread, causing further data breaches. Ransomware holds internal systems captive, demanding a paid ransom before returning stolen data and unlocking systems.

How does one maintain vigilance in the midst of an active attack? Being very careful when opening email and avoid clicking links or attachments from anyone. It’s easy to get busy with our daily routines and just click something in a rush. But don’t. Take a moment to determine if indeed you really should or even need to click something. A quick phone call to the sender will be an efficient way to get an answer.

Paying the ransom is still being considered but is not yet determined. Giving into the ransomware demands would restore hacked data and unlock the services frozen through encryption. Should the city not pay the hackers, each computer would have to be manually restored, taking days and possibly weeks.

The attack has caused several city public functions to shut down, with the Atlanta Municipal Court system forced to reschedule court dates, as access to court and legal information is currently unavailable. Bill paying functions for water bills and traffic tickets are also locked out. The total extent of damage is still being assessed. Atlanta-based SecureWorks was hired to restore city systems and protect against future attacks.

It’s suspected that the ransomware known as SamSam may be behind the attack. Since 2015, SamSam has been wreaking havoc in cities across the US. The attacks have scorched healthcare systems and public services, often leaving them using pen and paper while the hacks are being resolved. This is exactly what happened in Colorado.

Earlier this month, the Colorado Department of Transportation was forced to shut down 2,000 computers in an effort to fight SamSam. In January, SamSam turned Hancock Health of Indiana into a virtual information lock-out, forcing them to cancel over 19,000 appointments and surgeries.

Paying a ransom or not is never an easy decision. The ransoms are typically not a prohibitive amount, but hackers make up for that in the volume of attacks.

The best way to thwart the hackers is to keep current backups of all critical data and systems. Organizations often do this during non-working hours or “light” working hours to avoid putting additional strain on networks. Some need to do backups hourly, some daily, and others more or even less often. It’s the responsibility of the organization to make these decisions and there is no right or wrong answer. Just make sure to do it and it could save many thousands of dollars and a lot of time trying to put everything back together.

Information security expert Andrew Green says about the Atlanta attack “…this is a wakeup call…cities need to start looking at how seriously they’re taking their own cybersecurity…”