Fulton County services coming back on ‘rolling basis’ after LockBit attack

Georgia’s Fulton County says it is on its way to restoring many of the systems brought down by a January ransomware attack by the LockBit gang.

The county posted an update to its government website on Monday saying its water billing platform has been restored, allowing residents to make online payments. County officials did not respond to requests for comment.

“Fulton County has been working continuously to restore services. We have made significant progress in this effort. Services are being restored on a rolling basis,” the county said.

The Fulton County justice system is also now operational, according to the statement, thanks to backups. Several justice system offices are still having wide-ranging issues with phone systems and e-filing platforms.

The county is also still dealing with issues related to the tax commissioner’s office. Property owners can submit some applications online, but not property tax payments.

The statement notes that election systems were never affected by the ransomware attack.

“We are committed to a comprehensive investigation, and our teams are working to understand what specific information may have been affected as a result of this incident,” the county said. “If we determine that peoples’ personal information was involved in this incident, we will make all legally required notifications.”

The attack has caused weeks of disruptions, hampering everything from marriage licenses to police reports. While all offices have reopened, many are still operating with paper forms and manual processes as a result of the attack.

The attack was claimed by the LockBit ransomware gang — which was taken down by the U.K.’s National Crime Agency, FBI and dozens of law enforcement agencies two weeks ago.

Last week, the gang tried to revive its floundering operation and its leader posted a lengthy screed falsely claiming the operation was launched because of the attack on Fulton County — the most populous in Georgia and home to the city of Atlanta. The FBI and U.K. officials said their infiltration of LockBit’s operations began in 2022.

The message claimed that law enforcement took down the ransomware gang’s infrastructure because they didn’t want to see information stolen from Fulton Country published due to court cases involving former President Donald Trump.

Fulton County District Attorney Fani Willis previously said all documents related to Trump’s trial are “kept in a separate, highly secure system that was not hacked and is designed to make any unauthorized access extremely difficult if not impossible.”

The ransomware gang claimed the information they had “could affect the upcoming US election” but eventually removed the county from its leak site, telling journalist Brian Krebs that a ransom was paid.

At a press conference on February 29, Fulton County Chairman Robb Pitts denied ever paying a ransom and said they do not know why LockBit removed the county from its new leak site.

“We have not paid any ransom. Nor has any ransom been paid on our behalf,” he said last week, noting that several county systems are still down, indicating they did not have access to a decryptor allowing them to restore several platforms.

Pitts warned that the hackers “could release whatever data they have at any time — today, tomorrow or sometime in the future.”