City of Atlanta confirms 'ransomware cyber attack' on network servers

ATLANTA — The Federal Bureau of Investigation and Department of Homeland Security are investigating a ransomware cyber attack to the City of Atlanta's network servers.

Atlanta COO Richard Cox confirmed the attack in a news conference Thursday afternoon. He said it happened at 5:40 a.m.

Cox said several departments have been affected by the attack, but departments of public safety, water services and operations and airport are operating without incident. Cox said the attack will not impact payroll.

The urgent search to find out if hackers stole people’s personal information, on Channel 2 Action News at Noon. 

Mayor Keisha Lance Bottoms warned employees to monitor their bank accounts because they don't know what information has been compromised in the attack.

"This is a very serious situation," she said. "We don't know the extent, so I would ask for people to assume that you may be included."

She also said the possible compromised information may belong to the public.

"Let's just assume that if your personal information is housed by the City of Atlanta, whether it be because you are a customer who goes online and pays your bills or any employee or even a retiree, we don't know the extent, so we just ask that you be vigilant," Bottoms said.

Bottoms said other government entities and businesses across the country are experiencing the same thing.


She confirmed that they did receive a ransom note demanding $50,000, but could not say whether officials were considering paying that ransom.

The city has been experiencing outages on internal and external networks, that are affecting the ability to pay bills and access court-related information.

“At this time, our Atlanta Information Management team is working diligently with support from Microsoft to resolve the issue. We are confident that our team of technology professionals will be able to restore applications soon. Our City website,, remains accessible and we will provide updates as we receive them,” city spokeswoman Anne Torres said in a statement.

Channel 2's Mark Winne confirmed with FBI spokesman Kevin Rowson that they are looking into it.

The city says it is working with support teams from Microsoft to regain control of all systems.

Channel 2's Justin Wilfon spoke with a security expert Thursday night. Tony Ucedvelez, CEO of Versprite, a cyber security company, said these kinds of attackers typically only want the ransom, not anyone's personal information.

"Those who are launching ransomware-based attacks are looking to attack services that people need right now and immediately," Ucedvelez said.

By interrupting basic city services, Ucedvelez told Wilfon that the attackers essentially hold city officials hostage, hoping they'll decide to pay up.