Coweta County, Ga., Largely Restores Servers Following Ransomware Attack

Servers had been backed up the night before the attack, prompting officials not to pay the roughly $340,000 ransom.

by Raisa Habersham, The Atlanta Journal-Constitution / August 31, 2018

(TNS) — Coweta County, Ga., has restored most of its computer servers, nearly two weeks after hackers demanded $341,000 in bitcoins in the latest ransomware attack to impact metro Atlanta government.

The county’s information technology servers were compromised about 6:30 a.m. Aug. 19, limiting access to tags, courts and other services, officials said.

The county restored servers for airport, voter registration, court and public safety services Tuesday, according to a statement on the county’s website.

“We are pleased to announce that our IT staff is now substantially complete with restoration of County servers and workstations,” county officials said in the statement. “... One area still being worked on are the public computer stations at our libraries. We will let you know when they have been returned to service.”

While the attack did not compromise the county’s workstations, phone systems or external sites, all servers were shut down as a precaution.

The county servers were backed up the night before the hack, Coweta County spokesman Tom Corker said. While hackers did not ask for a dollar amount, they did request 50 bitcoin, which is the equivalent of roughly $341,000.

Corker said the city did not pay the ransom.

It is the county’s first ransomware attack, Corker said.

Coweta County is not the first local government targeted in an attack.

In March, hackers held for ransom much of Atlanta’s computer network, disrupting city services and forcing some departments to perform their jobs on paper.

In that case, they demanded $51,000 in bitcoins.

The city refused to pay the ransom on the advice of federal agents.

©2018 The Atlanta Journal-Constitution (Atlanta, Ga.) Distributed by Tribune Content Agency, LLC.