Atlanta spent ~$2.6M on recovery efforts after the ransomware attack against city's systems, though it isn't clear if the city tried to pay the ~$50,000 ransom
no, Atlanta didn't pay the ransom. http://www.techmeme.com/... http://www.zdnet.com/...
Context & Ripple Effects
A month after the sustained attack on Atlanta's city systems made national news, the bill is coming into focus: roughly $2.6 million in recovery spending against a ransom demand of only about $50,000, with the city denying it paid. The asymmetry is the story — cleanup cost the city more than fifty times what the attackers asked for.
Atlanta is the first data point in a string of municipal hits that followed: Baltimore later put its own cleanup at $10M plus lost revenue (Baltimore's $10M estimate), Florida towns chose to pay six-figure ransoms rather than rebuild (Riviera City and Lake City paid), and Oakland confirmed an attack on its networks in 2023.
First-order effects
- Atlanta's taxpayers absorb a ~$2.6M recovery bill for a demand they could have settled for ~$50K, while the city's public refusal to pay sets the negotiating posture every future victim city will be measured against.
Second-order effects
- Other cities facing the same choice see the trade-off sharpened: Baltimore's $10M estimate and Riviera City's and Lake City's decisions to pay show municipalities splitting between rebuilding at multiples of the ransom and quietly capitulating.
- The 'recovery' market itself gets distorted — ProPublica reported US data-recovery firms marketing hi-tech unlock solutions were actually just paying the ransom and marking it up, meaning cities may be funding attackers through intermediaries even when they publicly refuse.
Third-order effects
- If the pattern holds — Atlanta, Baltimore, the Florida towns, Oakland — municipal networks become a standing ransomware revenue class, and the real cost driver shifts from ransom size to whether cities invest in resilience before the hit rather than cleanup after it.
The trend: US city governments are becoming a repeat ransomware target class where recovery costs dwarf the ransoms themselves, forcing each new victim into a public pay-or-rebuild decision.