City of Atlanta officials are struggling to determine how much sensitive information may have been compromised in a Thursday cyber attack.

They urged employees to check their bank accounts to make sure their financial information had not been accessed and said that anyone who had conducted transactions with the city could be at risk.

Employees at Atlanta City Hall are being handed instructions as they come through the front doors to not turn on computers or log on to their workstations. JOHN SPINK / AJC
icon to expand image

“Because we don’t know, I think it would be appropriate for the public just to be vigilant in checking their accounts and making sure their credit agencies have also been notified,” Mayor Keisha Lance Bottoms said at a Thursday press conference.

The city has also received demands that it pay a ransom of an unspecified amount, officials confirmed. But officials had yet to make a determination if it would pay the ransom.

“We can’t speak to that right now,” Bottoms said. “We will be looking for guidance, specifically from our federal partners.”

The FBI, the Department of Homeland Security and the Secret Service had been called on for advice.

For years, the FBI has warned that the use of ransomware — malicious software that threatens to block access to data or to publish it unless the infected organization pays a ransom — is a fast growing criminal enterprise.

Organizations often don’t learn they have been infected until they can’t access their data or until computer messages appear demanding a ransom payment in exchange for a decryption key, according to the FBI’s website.

The messages include instructions on paying the ransom, usually in the form of bitcoins — a crypto currency that allows for anonymous transactions online.

Both Davidson County North Carolina and the Colorado Department of Transportation suffered ransomware attacks last month.

The city’s Department of Atlanta Information Management at 5:40 a.m. Thursday learned of outages of various internal and customer applications “including some applications customers use to pay bills or access court related information,” said Richard Cox, the city’s interim Chief of Operations.

Cox called it a “ransomware cyber attack.”

Instructions given to employees at Atlanta City Hall on Friday, March 23, 2018.
icon to expand image

The public safety department, water services and the Hartsfield-Jackson Atlanta International Airport operated without incident, Cox said.

Cox said the city would offer employees additional resources to help them protect their information in coming days.

Bottoms said that the city’s municipal courts should be open on Friday.

Atlanta Police Chief Erika Shields said that her department’s emergency response system had not been affected at all.

Shields said that officers had reverted to writing reports on paper out of an abundance of caution, but that as far as she knew the police departments computer systems were still operational.

Shields insisted that earlier reports attributed to a department memo that warned that payroll might be disrupted were not true.

“We did not put out a memo,” Shields said. “I can’t control what is said. I’m deferring to experts here who said, ‘It won’t be affected.’ And I believe them.”

Bottoms also said that city’s 8,000 employees would be paid on Friday.

“I’ll be signing signing 8,000 checks today if necessary,” Bottoms said.

The AJC's Stephen Deere keeps you updated on the latest happenings at Atlanta City Hall. You'll find more on myAJC.com, including these stories:

Never miss a minute of what's happening in Atlanta politics. Subscribe to myAJC.com.