Scourge · March 22 2018

The Scourge of SamSam in Atlanta

Chronicle

At dawn on 22 March 2018 SamSam ransomware locked Atlanta's municipal systems: bill payment, courts, parking, job applications. For weeks city staff went back to paper forms. The attackers asked for about $51,000 in bitcoin; the city did not pay, but recovery cost millions. In late 2018 two Iranian nationals were indicted in the US for the SamSam campaign.

Lesson learned

It made clear that local governments, with old systems and small budgets, are tempting targets, and that the cost of an attack goes far beyond the ransom demanded.

Prayer of reparation

O SamSam, who came in through doors left open to the Internet, grant our cities a budget for patches and not just for printer paper. Amen.

How it is remembered

Remembered by closing exposed remote-access services, using strong passwords and MFA, and rehearsing the restoration of municipal systems before it's needed.