Atlanta's city government went back to paper

The story

In March 2018, ransomware called SamSam locked up computer systems across the City of Atlanta. The city confirmed the attack on March 22.

Many services stopped working, including utility billing, parking and courts. Employees went back to filling in paper forms by hand while systems were restored.

SamSam did not usually arrive by phishing email. Its operators looked for systems they could reach from the internet and guessed weak passwords until one worked. An audit of the city’s systems in January 2018, two months earlier, had found between 1,500 and 2,000 vulnerabilities and warned that the backlog had grown so large that staff had become used to it.

In November 2018, two Iranian men were charged with creating and using SamSam against Atlanta and other targets.

Why it mattered

Recovery cost the city many times what the attackers had demanded, and months later a third of its software was still offline or only partly working. Legal documents and police video were lost for good. The warnings in the earlier audit showed the risk had been known; what was missing was the time and attention to act on it.

The lesson today

Atlanta knew it had problems before the attack. A long list of open issues that nobody works through is a list of ways in. Closing known gaps steadily, starting with weak passwords on anything reachable from the internet, does more than any single tool.