Baltimore had no written recovery plan when ransomware hit

The story

On May 7, 2019, ransomware called RobbinHood infected most of the City of Baltimore’s government computers. Apart from essential services, the city took its servers offline. The attackers demanded payment in bitcoin, with a deadline after which they said the data would be lost for good.

The effects spread quickly. Property sales could not be completed because the systems that handled them were down. City employees lost email and some set up free personal accounts to keep in touch, until the email provider blocked the accounts for being created in a sudden burst.

The city did not pay. Recovery, first expected to take a few weeks, lasted until September. Baltimore’s IT director was criticized for not having a written disaster recovery plan, and left the role later that year.

Why it mattered

Baltimore’s recovery was estimated to cost many times the ransom it refused to pay, and it took about four months. Without a written recovery plan, every decision had to be made in the middle of the crisis, while property sales and city services waited.

The lesson today

Without a plan, every decision during a crisis is made for the first time, under pressure. A written recovery plan answers the hard questions ahead of time: which systems come back first, how long that should take, how people communicate in the meantime and who makes the calls.