Ransomware attacks ravaged municipal governments in March

Ransomware attacks caused prolonged disruptions for several municipalities in March, impairing public services and forcing government workers to use pen and paper.

Despite recent law enforcement actions, including a takedown operation against the LockBit ransomware gang in February, the threat continued last month. Municipalities took the brunt of attacks, with the Medusa ransomware gang claiming responsibility for two of them. Following the attacks, cities and counties across the U.S. struggled to restore services; for some municipalities, it wasn't the first time they were disrupted by ransomware.

On March 26, government officials in Gilmer County, Ga., disclosed that multiple services were down following a ransomware attack. Officials posted a notice on the city's website to warn residents of the disruptions, though it has since been taken down. The Record reported that the notice stated the county "recently detected and responded to a ransomware incident and has taken affected systems offline." Officials warned residents to expect delays as the city worked to restore services. Gilmer has not released an official statement.

One day prior, the police department for the city of St. Cloud, Fla., disclosed through Facebook that the city was experiencing a ransomware attack. While it confirmed 911 lines remained operational, residents were instructed to make payments to the city in cash only due to affected systems.

The city posted additional information on the St. Cloud website, though it referred to the incident as a cyberattack and did not mention ransomware. The statement confirmed law enforcement was investigating the attack and that the city implemented additional measures to continue services while systems remained down. While the transfer station remained open and accepted cash payments, the Toho Water Authority's customer service office at City Hall was closed.

Veronica Miller, St. Cloud city manager, issued an update on Tuesday that revealed the city was still "working to determine the full nature, scope and any impacted data." She emphasized the incident did cause disruptions but applauded the IT staff for their rapid response.

On March 22, The Record reported that Henry County, Ill., was hit by ransomware on March 18. Mat Schnepple, director of the emergency management office for Henry County, told The Record that the city forced systems offline and engaged law enforcement following the attack. Medusa claimed responsibility for the attack through its public leak site and demanded $500,000.