A list of what appeared to be documents from a Fulton County data breach has disappeared from a hacking group’s website after a countdown clock for the release of data reached zero, the Atlanta Journal-Constitution reported.
The LockBit hacking group had posted screenshots of what appeared to be legitimate county documents and information about county computer services, according to the report, with a deadline of 12:47 a.m. Eastern time on Friday.
But less than a half hour after that deadline passed, the post disappeared from the LockBit site. It’s unclear if Fulton County paid a ransom to prevent the data from being released to the public.
Fulton County Commission Chairman Robb Pitts confirmed on Wednesday that cybercriminals had claimed responsibility for the computer attack that shut down many of the government’s services.
LockBit was the most deployed ransomware variant across the world in 2022, according to the U.S. Cybersecurity & Infrastructure Security Agency. It has been used to attack organizations across critical infrastructure sectors that include government and emergency services, financial services, energy, healthcare, and education.
Original Story
Cybercriminals have claimed responsibility for a ransomware attack that shut down many Fulton County computer systems, Commission Chairman Robb Pitts said in a briefing held Wednesday afternoon.
“While our investigation remains ongoing, we do have evidence that suggests this was the result of a ransomware incident caused by financially motivated actors,” Pitts said.
Investigators became aware of cybercriminals who were claiming responsibility for the attack on the dark web. Screenshots of information the cybercriminals claimed were accessed from county systems are being checked to determine if personal information was accessed by the criminals.
If the county determines sensitive personal information – whether it be employees or county residents – was involved, the affected parties will be notified as required by law, with resources provided to help protect their information.
He said Fulton County is aware of multiple other local governments across the United States that are working to recover from similar incidents mounted by cybercriminals.
Since the cyber attack more than two weeks ago, one-third of the county’s phone lines have been restored, Pitts said. The county email system was not affected. Internet service is in place including public Wi-Fi in most facilities, he said.
Elections offices are open and preparations continue for next month’s primary elections, with election workers prepared to start early voting on Monday.
The board of assessors continues operations and is accepting homestead exemption applications manually, and Board of Equalization hearings are continuing. Customers with property tax questions can contact those offices by phone.
Jury service continues normally at the Superior Court, Pitts said. The county’s electronic warrant system is operational with most scheduled hearings continuing. First-appearance hearings also continue.
“We’re working hard to bring our property tax system back online. But at this time we cannot process payments and some other transactions,” Pitts said.
Water billing is still down, and the county is unable to accept electronic payments. However, he said customers will not be charged late fees and service disconnections will not occur during this incident.
Some delays have occurred in the justice system, with each court agency publishing updates online with details and notices of workarounds.
Sheriff Pat Labatt was thanked in person by Pitts for the work he and his employees have done to continue jail operations while IT systems have been down. They used backup processes, including paper records, to handle jail operations.
“We will continue to work with law enforcement and our outside experts to understand exactly what happened and to further strengthen the security of our system going forward,” Pitts said.
Check the Fulton County website for ongoing updates on system restoration.