At the end of August, Norcross officials notified residents that the city had recently identified “a ransomware incident that occurred on Aug. 1 … which impacted certain computer systems.”
The Aug. 28 announcement said city officials contacted experienced cybersecurity professionals and law enforcement as soon as they detected the incident. Those parties are continuing to investigate the Aug. 1 breach.
While most of the city’s systems are operational, Norcross told residents that they may experience limited disruptions to certain services as the city completes its restoration efforts and implements additional security measures.
More questions than answers
At the end of the city council’s Sept. 8 meeting, Norcross officials mentioned a possible update on the cybersecurity incident at their closed-door executive session, following regular order.
Council member Andrew Hixson said he wanted an update before colleagues voted to adjourn for a private discussion.
“I’m getting a lot of questions from the mailouts,” Hixson said. “Just what we can and cannot say … getting a little frustrated.”
On Wednesday, Sept. 9, a Norcross spokesperson said the city is continuing to work with cybersecurity professionals and law enforcement to investigate the incident’s nature and scope.
A ransomware incident is commonly understood as a cyberattack where software locks and/or encrypts a victim’s data and systems. Typically, the attackers will demand payment in untraceable cryptocurrency to restore access.
Rough Draft Atlanta asked city officials on Sept. 9 which specific systems or data sets were accessed, who or what the victim was, and whether payment was demanded.
“Because the investigation remains ongoing, we are not in a position to comment on specific systems that may have been affected, investigative findings, or other details beyond those included in the city’s public statement,” Community Relations Manager Julie Brechbill wrote. “The city remains focused on restoring affected systems safely and securely and will provide additional information as appropriate if and when it becomes available.”
