COWETA, Okla. — City computers in Coweta remain locked down following a system-wide ransomware attack earlier this week, but city leaders said they have no plans to pay the hackers who are responsible.
On Wednesday, hackers targeted the City of Coweta with a ransomware strain known as Anubis.
The attack encrypted local files, Word documents, Excel spreadsheets and municipal financial systems across city hall.
The attackers sent messages demanding a ransom, but city officials said they refuse to open a line of communication.
“They’ve demanded a ransom,” explained Coweta City Manager Julie Casteen. “We don’t know what the amount is because we’re not communicating with them. We just refuse to do that.”
Casteen said the firm stance comes from her own past experience working in another municipality where paying a ransom failed to solve the problem.
“I’ve been through that process before with another city and we actually got reinfected two weeks after we paid the ransom. I think there’s a lot of different thoughts on that, but a lot of people feel if you pay the ransom, it makes the attackers realize, ‘Oh, they paid it once. Let’s hit them again.'”
For residents concerned about sensitive personal data, city leaders emphasized that credit card and payment information were not compromised.
Payment processing is managed on an independent cloud served that was not accessed during the breach.
Emergency services—including 911 dispatch, the police department and the fire department—run on separate offsite networks and remain fully operational.
“There has been no infiltration onto our city payment system. That is a separate system held in the cloud and we can assure you that no citizen payment information has been accessed.”
Contracted IT professionals, cyber insurance experts, local police and the FBI are reviewing server logs to determine how the intrusion occurred.
In the meantime, the city plans to restore its computer network using an offsite backup with a target of having systems fully operational by Monday.
While the outage continues, water shutoffs for nonpayment and late penalties are suspended.
Residents can still pay utility bills online via Xpress Bill Pay through the city website or by dropping off a check at City Hall.
City staff members are also onsite to assist residents who prefer to pay in-person.
The city is currently working to upgrade its internal network security system from standard multi-factor authentication to passkeys to prevent future breaches.
Additional updates are expected early next week.
