incident · 1521676800000

City of Atlanta SamSam Ransomware Attack

The City of Atlanta suffered a devastating SamSam ransomware attack that crippled municipal services, forcing officials to resort to paper processes.

What happened

Attackers deployed SamSam ransomware across the city's IT infrastructure, encrypting databases and applications. The attack disrupted services including utility payments, parking, and court systems, and destroyed years of data.

Technical mechanism

SamSam ransomware was deployed after attackers gained access, likely through brute-forcing weak passwords on internet-facing services, rather than traditional phishing.

Why it matters

The attack demonstrated the severe vulnerability of local governments to ransomware and the massive costs associated with recovery compared to proactive security investment.

Impact

Significant disruption to city services for weeks. The city spent an estimated $2.7 million on emergency response and contractors, with total recovery costs projected much higher.

Response

The city shut down affected systems, engaged incident response firms and federal law enforcement, and rebuilt IT infrastructure. The DOJ later indicted two Iranian nationals for the attack.

Defensive lessons

  • Local governments must prioritize IT infrastructure upgrades and security funding.
  • Robust, offline backups are essential for ransomware recovery.
  • Internet-facing services must use strong authentication and avoid weak passwords.

Evidence register

  1. Department of Justice — Atlanta U.S. Attorney Charges Iranian nationals for City Of Atlanta Ransomware Attack (verified)