Atlanta government ransomware attack

<h2 id="approach-and-attack">Approach and attack</h2>
Leading up to the attack, the Atlanta government was criticized for a lack of spending on upgrading its IT infrastructure, leaving multiple vulnerabilities open to attack. In fact, a January 2018 audit found 1,500 to 2,000 vulnerabilities in the city's systems, and suggested that the number of vulnerabilities had grown so large that workers grew complacent.<a class="footnote-ref" id="fnref:8" href="#fn:8">8</a> The virus used to attack the city was the SamSam Ransomware, which differs from other <a href="/facts/Ransomware/muT4jcxj">ransomware</a> in that it does not rely on <a href="/facts/Phishing/hvgfz4U8">phishing</a>, but rather utilizes a <a href="/facts/Brute-force_attack/TXl8pkfb">brute-force attack</a> to guess weak passwords until a match is found. It is known to target weaker IT infrastructures and servers.<a class="footnote-ref" id="fnref:9" href="#fn:9">9</a> The ransomware has prominently been behind attacks on medical and government organizations since its discovery in 2016, with previous attacks on targets ranging from small towns such as <a href="/facts/Farmington,_New_Mexico/du2382Yz">Farmington, New Mexico</a> to the <a href="/facts/Colorado_Department_of_Transportation/CUeAB9QI">Colorado Department of Transportation</a> and the <a href="/facts/Erie_County_Medical_Center/7fS9lLMz">Erie County Medical Center</a>. It can also bypass <a href="/facts/Antivirus_software/GGMqsfkJ">antivirus software</a>.<a class="footnote-ref" id="fnref:10" href="#fn:10">10</a> Despite no suspects being identified or indicted until November 2018, the SamSam hackers were described as "opportunistic".<a class="footnote-ref" id="fnref:11" href="#fn:11">11</a>
On March 22, at 5:40 AM, the Department of Atlanta Information Management first learned of outages on various internal and customer applications “including some applications customers use to pay bills or access court related information,” according to Richard Cox, the city's interim Chief of Operations. Soon afterward, the city shut down many of its digital services in an attempt to control the situation, including its court system database and the wi-fi at <a href="/facts/Hartsfield%E2%80%93Jackson_Atlanta_International_Airport/ev2ekh61">Hartsfield–Jackson Atlanta International Airport</a>. The city eventually identified it as a ransomware attack.<a class="footnote-ref" id="fnref:12" href="#fn:12">12</a><a class="footnote-ref" id="fnref:13" href="#fn:13">13</a>

<h2 id="aftermath-and-recovery-efforts">Aftermath and recovery efforts</h2>
This hack was notable as it was the largest successful breach of security for a major American city by ransomware, potentially affecting up to 6 million people.<a class="footnote-ref" id="fnref:14" href="#fn:14">14</a><a class="footnote-ref" id="fnref:15" href="#fn:15">15</a> Following the attack, the city of Atlanta cooperated with the <a href="/facts/Federal_Bureau_of_Investigation/UY93jwX6">FBI</a>, <a href="/facts/Department_of_Homeland_Security/jwz5gLfa">Department of Homeland Security</a>, and <a href="/facts/United_States_Secret_Service/SsbfALvK">Secret Service</a> and hired security firms such as <a href="/facts/SecureWorks/Gj2tUjpu">SecureWorks</a> to investigate, and many government computers were advised to stay powered off until 5 days later.<a class="footnote-ref" id="fnref:16" href="#fn:16">16</a>
Though the city declared that there was little to no evidence that personal data had been compromised, later studies show that the breach was worse than originally estimated. In June 2018, it was estimated that a third of the software programs used by the city remained offline or partially disabled.<a class="footnote-ref" id="fnref:17" href="#fn:17">17</a> In addition, many legal documents and police dashcam video files were permanently deleted, though the police department was able to restore access to all its investigation files.<a class="footnote-ref" id="fnref:18" href="#fn:18">18</a> For a while, residents were forced to pay their bills and forms by paper.<a class="footnote-ref" id="fnref:19" href="#fn:19">19</a>
In response to this hack, Atlanta devoted $2.7 million to contractors in order to recover, but later estimated it would need $9.5 million.<a class="footnote-ref" id="fnref:20" href="#fn:20">20</a>
On November 26, 2018, the Department of Justice indicted two Iranian hackers for the attack, charging that Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri were part of the SamSam group and created SamSam Ransomware.<a class="footnote-ref" id="fnref:21" href="#fn:21">21</a>

<h2 id="references">References</h2>

<ol>
<li id="fn:1">Brumback, Kate (March 23, 2018). "Atlanta city computer network remains hobbled by cyberattack". AP News. Retrieved August 8, 2023. <a href="https://apnews.com/article/efcf232b7202479e808632557d58774c" target="_blank">https://apnews.com/article/efcf232b7202479e808632557d58774c</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></li>
<li id="fn:2">"Atlanta, GA : Ransomware Cyberattack Information". www.atlantaga.gov. Archived from the original on July 18, 2018. Retrieved March 28, 2018. <a href="https://web.archive.org/web/20180718205511/https://www.atlantaga.gov/government/ransomware-cyberattack-information" target="_blank">https://web.archive.org/web/20180718205511/https://www.atlantaga.gov/government/ransomware-cyberattack-information</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></li>
<li id="fn:3">Deere, Stephen (March 23, 2018). "Atlanta officials warn cyber attack may compromise sensitive data". The Atlanta Journal-Constitution. ISSN 1539-7459. Retrieved August 8, 2023. <a href="https://www.ajc.com/news/crime--law/atlanta-officials-warn-cyber-attack-may-compromise-sensitive-data/afZLYCO14WySObFATzKXRP/" target="_blank">https://www.ajc.com/news/crime--law/atlanta-officials-warn-cyber-attack-may-compromise-sensitive-data/afZLYCO14WySObFATzKXRP/</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></li>
<li id="fn:4">Blinder, Alan; Perlroth, Nicole (March 27, 2018). "A Cyberattack Hobbles Atlanta, and Security Experts Shudder". The New York Times. Archived from the original on January 11, 2022. <a href="https://www.nytimes.com/2018/03/27/us/cyberattack-atlanta-ransomware.html" target="_blank">https://www.nytimes.com/2018/03/27/us/cyberattack-atlanta-ransomware.html</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></li>
<li id="fn:5">Kearney, Laila (March 23, 2018). Maler, Sandra (ed.). "Atlanta ransomware attack throws city services into disarray". Reuters. <a href="https://www.reuters.com/article/usa-georgia-cyber/atlanta-ransomware-attack-throws-city-services-into-disarray-idUSL1N1R51V9" target="_blank">https://www.reuters.com/article/usa-georgia-cyber/atlanta-ransomware-attack-throws-city-services-into-disarray-idUSL1N1R51V9</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></li>
<li id="fn:6">Hutcherson, Kimberly (March 27, 2018). "Six days after a ransomware cyberattack, Atlanta officials are filling out forms by hand". CNN. <a href="https://www.cnn.com/2018/03/27/us/atlanta-ransomware-computers/index.html" target="_blank">https://www.cnn.com/2018/03/27/us/atlanta-ransomware-computers/index.html</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></li>
<li id="fn:7">Perlroth, Nicole; Benner, Katie (November 28, 2018). "Iranians Accused in Cyberattacks, Including One That Hobbled Atlanta". The New York Times. Archived from the original on January 14, 2022. Retrieved November 30, 2018. <a href="/wiki/Katie_Benner" target="_blank">/wiki/Katie_Benner</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></li>
<li id="fn:8">"ISO/IEC 27001 ISMS Precertification Audit". City Auditor's Office. January 2018. <a href="http://www.atlaudit.org/isoiec-27001-isms-precertification-audit---january-2018.html" target="_blank">http://www.atlaudit.org/isoiec-27001-isms-precertification-audit---january-2018.html</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></li>
<li id="fn:9">Freed, Benjamin (April 24, 2018). "Atlanta was not prepared to respond to a ransomware attack". StateScoop. Retrieved July 18, 2018. <a href="https://statescoop.com/atlanta-was-not-prepared-to-respond-to-a-ransomware-attack" target="_blank">https://statescoop.com/atlanta-was-not-prepared-to-respond-to-a-ransomware-attack</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></li>
<li id="fn:10">Crowe, Jonathan (March 2018). "City of Atlanta Hit with SamSam Ransomware: 5 Key Things to Know". Barkly vs Malware. Barkly Protects, Inc. Archived from the original on July 18, 2018. Retrieved July 18, 2018. <a href="https://web.archive.org/web/20180718205025/https://blog.barkly.com/atlanta-ransomware-attack-2018-samsam" target="_blank">https://web.archive.org/web/20180718205025/https://blog.barkly.com/atlanta-ransomware-attack-2018-samsam</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></li>
<li id="fn:11">"SamSam ransomware attacks have earned nearly $850,000". CSO Online. IDG. March 23, 2018. Retrieved July 18, 2018. <a href="https://www.csoonline.com/article/3263693/security/samsam-ransomware-attacks-have-earned-nearly-850-000.html" target="_blank">https://www.csoonline.com/article/3263693/security/samsam-ransomware-attacks-have-earned-nearly-850-000.html</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></li>
<li id="fn:12">Deere, Stephen (March 23, 2018). "Atlanta officials warn cyber attack may compromise sensitive data". The Atlanta Journal-Constitution. ISSN 1539-7459. Retrieved August 8, 2023. <a href="https://www.ajc.com/news/crime--law/atlanta-officials-warn-cyber-attack-may-compromise-sensitive-data/afZLYCO14WySObFATzKXRP/" target="_blank">https://www.ajc.com/news/crime--law/atlanta-officials-warn-cyber-attack-may-compromise-sensitive-data/afZLYCO14WySObFATzKXRP/</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></li>
<li id="fn:13">"Atlanta, GA : Ransomware Cyberattack Information". www.atlantaga.gov. Archived from the original on July 18, 2018. Retrieved March 28, 2018. <a href="https://web.archive.org/web/20180718205511/https://www.atlantaga.gov/government/ransomware-cyberattack-information" target="_blank">https://web.archive.org/web/20180718205511/https://www.atlantaga.gov/government/ransomware-cyberattack-information</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></li>
<li id="fn:14">Freed, Benjamin (April 24, 2018). "Atlanta was not prepared to respond to a ransomware attack". StateScoop. Retrieved July 18, 2018. <a href="https://statescoop.com/atlanta-was-not-prepared-to-respond-to-a-ransomware-attack" target="_blank">https://statescoop.com/atlanta-was-not-prepared-to-respond-to-a-ransomware-attack</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></li>
<li id="fn:15">Poon, Linda (March 30, 2018). "Why Are Cities So Vulnerable to Cyber Attack?". Bloomberg. Retrieved July 18, 2018. <a href="https://www.citylab.com/life/2018/03/atlanta-city-hall-cyber-attack-ransomware-cesar-cerrudo/556703/" target="_blank">https://www.citylab.com/life/2018/03/atlanta-city-hall-cyber-attack-ransomware-cesar-cerrudo/556703/</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></li>
<li id="fn:16">Hutcherson, Kimberly (March 27, 2018). "Six days after a ransomware cyberattack, Atlanta officials are filling out forms by hand". CNN. <a href="https://www.cnn.com/2018/03/27/us/atlanta-ransomware-computers/index.html" target="_blank">https://www.cnn.com/2018/03/27/us/atlanta-ransomware-computers/index.html</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></li>
<li id="fn:17">Kearney, Laila (June 6, 2018). Adler, Leslie (ed.). "Atlanta officials reveal worsening effects of cyber attack". Reuters. Retrieved July 18, 2018. <a href="https://www.reuters.com/article/us-usa-cyber-atlanta-budget/atlanta-officials-reveal-worsening-effects-of-cyber-attack-idUSKCN1J231M?feedType=RSS&feedName=technologyNews" target="_blank">https://www.reuters.com/article/us-usa-cyber-atlanta-budget/atlanta-officials-reveal-worsening-effects-of-cyber-attack-idUSKCN1J231M?feedType=RSS&feedName=technologyNews</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></li>
<li id="fn:18">Vaas, Lisa (June 8, 2018). "Atlanta ransomware attack destroyed years of police dashcam video". Naked Security. Sophos. <a href="https://nakedsecurity.sophos.com/2018/06/08/atlanta-ransomware-attack-destroyed-years-of-police-dashcam-video/" target="_blank">https://nakedsecurity.sophos.com/2018/06/08/atlanta-ransomware-attack-destroyed-years-of-police-dashcam-video/</a> <a href="#fnref:18" class="footnote-back-ref">↩</a></li>
<li id="fn:19">Hutcherson, Kimberly (March 27, 2018). "Six days after a ransomware cyberattack, Atlanta officials are filling out forms by hand". CNN. <a href="https://www.cnn.com/2018/03/27/us/atlanta-ransomware-computers/index.html" target="_blank">https://www.cnn.com/2018/03/27/us/atlanta-ransomware-computers/index.html</a> <a href="#fnref:19" class="footnote-back-ref">↩</a></li>
<li id="fn:20">Kearney, Laila (June 6, 2018). Adler, Leslie (ed.). "Atlanta officials reveal worsening effects of cyber attack". Reuters. Retrieved July 18, 2018. <a href="https://www.reuters.com/article/us-usa-cyber-atlanta-budget/atlanta-officials-reveal-worsening-effects-of-cyber-attack-idUSKCN1J231M?feedType=RSS&feedName=technologyNews" target="_blank">https://www.reuters.com/article/us-usa-cyber-atlanta-budget/atlanta-officials-reveal-worsening-effects-of-cyber-attack-idUSKCN1J231M?feedType=RSS&feedName=technologyNews</a> <a href="#fnref:20" class="footnote-back-ref">↩</a></li>
<li id="fn:21">Perlroth, Nicole; Benner, Katie (November 28, 2018). "Iranians Accused in Cyberattacks, Including One That Hobbled Atlanta". The New York Times. Archived from the original on January 14, 2022. Retrieved November 30, 2018. <a href="/wiki/Katie_Benner" target="_blank">/wiki/Katie_Benner</a> <a href="#fnref:21" class="footnote-back-ref">↩</a></li>
</ol>

Atlanta government ransomware attack open-in-new

Atlanta government ransomware attack