Atlanta’s Cyber Attack

In case you hadn’t heard or read, the city of Atlanta has been hamstrung by a ransomware attack that began last Thursday.

The New York Times’ Alan Blinder and Nicole Perlroth provided an update yesterday.  The key facts thus far:

• This was one of the most “sustained and consequential cyberattacks ever mounted against a major American city.”
• It “laid bare once again the vulnerabilities of governments as they rely on computer networks for day-to-day operations.”
• The attackers, the “SamSam” hacking crew, locked up the city’s files, and gave the city a week to pay ~ $51,000 in ransom via Bitcoin.
• While the attack didn’t impact Atlanta’s 911 calls or wastewater treatment, “other arms of city government have been scrambled for days.” 
• But the Atlanta Municipal Court has been unable to validate warrants, police officers have been writing reports by hand, and the city has stopped taking employment applications.
• Dell SecureWorks and Cisco Security are working to restore the city’s systems, and the city’s mayor, Keisha Lance Bottoms, has not yet indicated whether the city would pay the ransom.

The Times also cited a 2016 survey of CIOs for jurisdictions across the country found that obtaining ransom was the “most common purpose of cyberattacks on a city or county government, accounting for nearly one-third of all attacks.”

In the meantime, many of Atlanta’s core public services are being delivered by that trusty and dependable standby, pen and paper.

If you’re interested in learning more about how to contend with ransomware, IBM Incident Response Services published this “Ransomeware Response Guide (Registration required).”