LockBit cyberattack: Fulton County refuses to pay ransom as deadline passes

FULTON COUNTY, Ga. - Fulton County leaders say they have not paid any ransom to the criminal group claiming responsibility for the cyberattack that affected several of the county's agencies.

The group LockBit had set a deadline of 8:49 a.m. on Thursday for Fulton County to pay the ransom or risk having stolen data leaked onto the dark web.

This was the second deadline LockBit had given the county. In both cases, county officials say they did not agree to the group's demands.

Fulton County Chairman Robb Pitts told FOX 5 that he is not aware of any reportedly stolen data being released so far.

But Pitts says the threat is far from over.

"They could release whatever data they have at any time," he said. "Today, tomorrow or sometime in the future. We have no control over that."

A spokesperson for Fulton County says they "still don't know" exactly what personal information was taken during the security breach and are  working to "determine what data may have been stolen and gain a better understanding of what information may be involved, which includes an extensive review process."

County leaders say they are working to keep data secure and have a plan in place to help anyone whose personal data may be released by the group.  

"The safety of our citizens is our highest concern, and we are taking this situation seriously as we continue our investigation," the spokesperson said.

The county's latest update on its efforts to restore its systems was on Feb. 22. In that update, the county says they have restored its water billing, GIS mapping, email systems, and more than half of its phone lines. Certain transactions remain limited while the county's Department of Information Technology works on the issue. For alternate contact information and a judicial services guide, click here.

Fulton County was removed from LockBit's site on the dark web on Thursday, but what that means remains unclear.

LockBit vs. Fulton County timeline

Jan. 29: A cyberattack in Fulton County disabled several crucial systems in late January. The unexpected county-wide IT outage affected phones, the court and tax systems and even the Fulton County Jail. As of Feb. 26, public booking records still cannot be accessed online.

Jan. 30: Many systems began recovering the following day, however some critical technology systems that impacted public services remained in the dark. At that time, authorities said there was no evidence that Personally Identifiable Information (PII) had been compromised.

Jan. 31: Fulton County Schools began investigating a breach of their computer systems. After a preliminary investigation at Alpharetta's FCS Innovation Academy, officials told FOX 5 students gained access to "certain Information Technology systems." The school district said this incident was unrelated to the ongoing cyber attack at the county level.

Feb. 1: The Georgia Secretary of State's Office announced Fulton County's access to the state voter registration system was being restricted as a precautionary measure.

Feb. 5: While remaining tight-lipped about the cyberattack, Fulton County officials began referring to the incident as a ransomware attack. Many of the county's systems remained offline. During a press conference, Fulton County Board of Commissioners Chairman Robb Pitts made a point to say there was no evidence the attack was related to the election process or other current events.

Feb. 14: LockBit claimed responsibility for the ongoing cyber issues in Fulton County, also claiming to have accessed confidential documents and personal data of citizens. Chairman Pitts confirmed the hackers were after money, but did not disclose how much.

Feb. 19: LockBit's site on the dark web was intercepted by international law enforcement. Fulton County told FOX 5 they did not use taxpayer money or give in to the ransom threat.

Feb. 26: A new site for LockBit 3.0 was set up on the dark web with another ransom and deadline. Several Fulton County systems remain down.

Feb. 29: The new ransom deadline passes in the morning. Fulton County is removed from LockBit's site, but systems remain down. 

What is LockBit?

The notorious ransomware group, LockBit, is a cybercriminal organization responsible for attacking over 2,000 victims worldwide, allegedly amassing over $120 million in ransom payments with issued demands totaling hundreds of millions of dollars.