The city of Augusta in the US state of Georgia said it suffered a serious “computer system outage” affecting its daily operations, but denied that it has been asked by a hacker group to pay a ransom of US$50 million.
The mayor of Augusta, Garnett Johnson said that the City started experiencing technical difficulties on May 21 and immediately launched an internal investigation to understand the nature and scope of the technical outage.
He said the investigation confirmed that external actors had gained unauthorised access to the City’s internal network.
“Our Information Technology Department is working diligently to investigate the incident, to confirm its impact on our systems, and to restore full functionality to our systems as soon as possible. We are also actively investigating to determine whether any sensitive data may have been impacted,” he said.
“At this time, we have not confirmed that any sensitive data was compromised, but we will update you as more information becomes available.”
A notorious group of threat actors going by the name “BlackByte” has claimed responsibility for the cyber attack on the City of Augusta and listed it as a victim on its data leak site. While the City said that it found no evidence of any sensitive data being compromised, the BlackByte ransomware gang claimed to be in possession of around 10 GB of data exfiltrated from the City’s internal network.
According to BleepingComputer, the leaked documents contain payroll information, contact details, personally identifiable information (PII), physical addresses, contracts, city budget allocation data, and more.
The ransomware group has quoted a price of US$400,000 for deleting the stolen data and offered to resell it to interested third parties for US$300,000.
Reports also surfaced that the City has received a ransom demand of US$50 million. Mayor Johnson, however, refuted such reports, stating that “recent media reports regarding Augusta, Georgia being held hostage for US$50 million in a ransomware attack are incorrect.”
“Augusta’s Information Technology Department continues to work diligently to investigate the incident, to confirm its impact on our systems, and to restore full functionality to our systems as soon as possible. We continue to investigate what, if any, sensitive data may have been impacted or accessed.
“We appreciate your continued patience and understanding and apologize for any inconvenience,” he added.
