Atlanta Ransomware Investigation Continues; Restoration Timeline Unclear

Atlanta Mayor Keisha Lance Bottoms speaking to the press at City Hall on Monday about last week’s cybersecurity attack.

Tasnim Shamma / WABE

Atlanta city officials said the investigation following Thursday’s ransomware attack has moved into a restoration mode, though its timeline remains unclear. The attack continues to affect some city operations.

At a press conference Monday, Mayor Keisha Lance Bottoms said they remain “in a hostage situation” with the hackers and are working around the clock on the issue.

The city has brought in Sandy Springs cybersecurity firm, Secure-Works to help.

While the hackers have been identified, Secure-Works chief executive Michael Cote said they would not release that information.

The timeline to complete the investigation also remains unknown.

“This is a marathon,” Cote said at the press conference. “We’ve done a lot of work cooperatively across the last three or four days, and I think we’re making a lot of progress.”

Lance Bottoms said the attack has pushed cybersecurity to the top of her administration’s priority list.

“Just as much as we focus on our physical infrastructure, we need to focus on the security of our digital infrastructure,” she said. “This is new territory for us but we are a resilient city.”

She said all options are on the table regarding large-scale system improvements.

“We have some thoughts as to what our vulnerabilities are, but this is not just about a fix for today. This is about a fix for our infrastructure going forward.”

Following the attack, many online city services are still down, including the bill-pay function for water bills and parking tickets. City employees are still unable to turn on their computers, and the airport has shut down WiFi as a precaution. No failure to appear in court penalties will be administered during this time.

The city requests that for further information, people call 311 or the Office of Constituent Services at (404) 330-6023.