Hacking group LockBit didn’t carry out its threat to expose stolen personal data of Fulton County residents, despite the passage of a Thursday-morning deadline — and despite no ransom payment, according to county Commission Chair Robb Pitts.
He spoke for two minutes Thursday afternoon, more than seven hours after the deadline expired.
“Right now, as I stand here at 4:08 p.m., we are not aware of any data having been released today so far,” Pitts said. “Now, that being said, that does not mean the threat is over by any means; and they could release whatever data they have at any time — today, tomorrow or sometime in the future. We simply have no control over that.”
“Once again, we have not paid any ransom, nor has any ransom been paid on our behalf,” he said.
The international ransomware group attacked over the weekend of Jan. 27-28, taking down many county systems, locking up computer files, and apparently stealing a trove of internal documents. The hackers set a countdown timer for the release of stolen data if an unspecified ransom wasn’t paid.
Pitts noted that an international law enforcement effort — not directly connected to the Fulton County attack — had taken down LockBit’s original site that listed hacking targets, but the group soon reestablished a site with a “renewed threat to release the purportedly stolen data.” The ransomware deadline was reset to expire at 8:49 a.m. Thursday.
After his remarks, Pitts left without taking questions. The county indicated ahead of time that few new details were likely to be released.
“Fulton County’s ransomware incident is still under investigation and we will not be able to speak to that investigation at this time,” the briefing announcement said.
The attack crippled many systems, including phones and online services. For days offices worked on paper and some bills could only be paid in person or by mail.
Pitts said Thursday the county is making “some progress” restoring its hacked systems, with some phone lines working now in every public department.
County officials eventually confirmed the attack was ransomware, but neither they nor LockBit specified the ransom demand.
An international law enforcement effort shut down the group’s dark web site Feb. 19 — including the countdown clocks for Fulton County and other hacking victims. But on Saturday, the group set a new countdown timer for release of Fulton County documents: Friday at 11:27 p.m.
Then the deadline moved up to 8:49 a.m. on Thursday.
Fulton County released a statement Monday afternoon acknowledging the renewed threat, and suggesting again that the county would not pay the unspecified ransom.
“Our focus remains on safely restoring services for our citizens and we continue to work in close coordination with law enforcement,” it says.
AJC staff writers Charles Minshew and Rahul Deshpande contributed to this report.
About the Author
