💰💣

City of Atlanta Security Incident

March 22, 2018 2741 days ago Resolved

Incident Overview

Situation Description

The City of Atlanta suffered a damaging ransomware attack from SamSam on March 22, 2018, disrupting operations and impacting multiple applications.

Event Types

Ransomware Malware / Destructive Attack

Industry Sector

Government

Geographic Scope

Local

Response Actions

Isolated Compromised Systems Restored Systems from Secure Backups Conducted Threat Hunting & Eradication Managed Public Narrative & Crisis Communications

Impact Analysis

Event Types (2 identified)

Ransomware Malware / Destructive Attack

Financial Impact

$0 USD

Records Affected

Data Types Compromised

N/A

Primary Impacts

Operational Disruption Reputational Damage

Key Decisions Made

The city's operations were completely disrupted for over a week due to the ransomware attack.; Key departments like public safety, water, and the airport were left unharmed, indicating segmentation was in place.; The city is working to fully recover and restore services, updating the public on progress.

Technical Analysis

Attack Method

Unpatched Vulnerability

Threat Actor Attribution

SamSam

Additional Information

Ransomware Alert: Lessons Learned from the City of Atlanta by Sarah Harvey / April 3rd, 2018 What Happened in Atlanta? On March 22 , the City of Atlanta suffered from an incredibly damaging ransomware attack from SamSam . Multiple types of applications, including internal and customer-facing applications that allow bill payment and access court-related documents, were compromised. For over a week, a cross-functional incident response team made up of the FBI, Department of Homeland Security, Microsoft, Cisco Security, and Dell SecureWorks have been working to find a resolution. In the meantime, the citys operations have been completely disrupted. Thousands of city employees could not access their computers, court dates were rescheduled, water bill payments had to be made in person by check, traffic tickets could not be processedthis ransomware attack has obstructed the day-to-day operations of the City of Atlanta. Fortunately, some key departments were left unharmed by this attack, including public safety, the water department, and Hartsfield-Jackson Atlanta International Airport. The city reported that theres been no evidence so far that customer or employee data has been compromised. GENERAL REMINDER: At this time, there is no evidence to show that customer or employee data has been compromised. However, customers and employees are encouraged to take precautionary measures to monitor and protect their personal information. City of Atlanta, GA (@CityofAtlanta) March 28, 2018 Why Did This Ransomware Attack Happen? The city hasnt given an official statement on why, but speculation is that critical cybersecurity best practices were not being met. The City of Atlantas ISO/IEC 27001 ISMS Precertification Audit Report from January 2018, just two months prior to this ransomware attack, reveals that the citys current Information Security Management System (ISMS) may not pass a certification audit based on gaps in policies and procedures, definitions of scope, formal...

... (truncated for display)

Quick Facts

Company:: City of Atlanta
Date:: March 22, 2018
Status:: Resolved
Decision Maker:: nan
Position:: nan
Published:: 3/04/2018

Source Information

Original Query

"City of Atlanta" ransomware attack recovery cost and process

View Original Source

Timeline

Information Published

3/04/2018

Incident Occurred

March 22, 2018 (2741 days ago)

Status: Resolved

Estimated resolution based on age

Actions

View Company Profile

Navigation

Quick Stats