Blogger calls Augusta ransomware attack ‘perhaps one of the largest government data thefts in recent years’

AUGUSTA, Ga. –
An overseas blogger is claiming that the ransomware attack against the City of Augusta “is perhaps one of the largest government data thefts in recent years in U.S.”

In a blog post Thursday, the author at SuspectFile.com begins his post by reiterating an early report of a $50M ransom was denied by both Mayor Garnett Johnson and the alleged outfit, BlackByte, claiming responsibility. FOX54 quoted a source close to the situation who claimed that amount on May 23. That source has since reiterated that $50M is relevant to this incident but did not elaborate.

Additionally, the website posted redacted documents that the blogger claims were sent to him via download links totaling 83GB of data. The site shared lists of documents it claims included “medical reports,” “health coverage,” “military info,” and tax documents.  As FOX54 reported via an independent source who also confirmed the release of data, there are many GIS files that were made available.

Also posted on the blogger’s site Thursday are an alleged city document, pay stub, and a Georgia driver’s license – all redacted.

FOX54 was first to break news of a ransomware attack in days following network activity slowdown. In the days that followed, the city confirmed that its network was infiltrated by an “unauthorized actor.” However, the city said that while it was aware of a cybercrime outfit claiming responsibility, city leaders affirmed that Augusta is not in communication with that group.

In a most recent update, the city of Augusta reported that all user credentials have been reset and validated. Additionally, it claims all internet access has been restored. As it stands, three systems are still in the process of being restored. They are Geographic Information Systems (GIS), the enterprise asset management system that depends on GIS and the solid waste operations system. They are expected to be up and running within two weeks.

The investigation into the breach continues and Augusta says that if sensitive personal information was exposed, the city is committed to taking all appropriate actions to notify those individuals.

Going forward, there are no more “weekly” updates planned going forward.