Almost one year after a ransomware attack struck the city of Cartersville, Ga., municipal officials revealed that they paid a ransom of $380,000 to regain access to their files.
The news was made known after the local Daily Tribune News filed a Freedom of Information Act request, which disclosed the payment to mitigate the May 4, 2019 attack. The Daily Tribune found that the initial ransom demand was for $2.8 million, payable in bitcoin, and that the city’s insurance paid the majority of the cost.
The attackers did deliver the decryptor keys necessary to regain access about 48 hours after the payment was made and all systems were operational soon thereafter.
The FOIA showed city officials learned the attackers used Ryuk ransomware and that police and other emergency services were impacted.
The city does not believe any information was removed, but there is no way to know if ransomware attackers have taken data.
If an organization pays the ransom, that does not mean the bad guys will comply and not make further use of the stolen information. The people behind ransomware attacks are criminals and not to be trusted, which is one of the primary reasons law enforcement officials typically take a stance against paying a ransom. It guarantees nothing.
“Stealing data simply gives them additional leverage to extort payment and, perhaps, other options for monetization – selling the data to other criminal groups or competitors, for example,” said Brett Callow, a threat analyst with Emsisoft.
