Two weeks after the city of Baltimore's networks suffered a ransomware attack, many of its systems remain offline, including utilities billing, phone, and email
Houses can't be sold, bills can't be paid while city networks are shuttered. — It's been nearly two weeks since the City …
Context & Ripple Effects
Baltimore is now the most visible entry in a string of ransomware strikes on American cities. [[a:927996|Atlanta spent much of 2018 recovering from one of the most sustained attacks ever mounted against a major US city]], and days into Baltimore's outage reporting tied the wave to the leaked NSA exploit EternalBlue, which hackers have used to paralyze Allentown, San Antonio, and Baltimore itself.
The stakes here are civic rather than corporate: with utilities billing, phone, and email dark for nearly two weeks, the city cannot process payments or property transactions. The arc continued afterward — Baltimore put the damage at $10M in cleanup plus $8M in deferred or lost revenue — and the target set kept widening, from cities to the managed service providers that run IT for smaller governments and clinics.
First-order effects
- Baltimore residents and businesses are directly blocked: houses can't be sold and utility bills can't be paid while billing and email systems stay shuttered.
- City operations grind on manual workarounds, and every offline week compounds deferred revenue the city will struggle to recover.
Second-order effects
- Peer cities face pressure to audit their own exposure to the same leaked NSA tooling, since EternalBlue has already hit Allentown, San Antonio, and Baltimore in sequence.
- The recovery bill — later tallied at $10M cleanup plus $8M lost revenue — pushes municipal budgets toward ransomware insurance, retained incident-response firms, and network segmentation spending.
Third-order effects
- If the pattern holds, municipal government becomes a standing ransomware target class: attackers route around hardened big-city defenses by hitting managed service providers that serve smaller cities, clinics, and businesses.
- Sustained outages of core services like billing and property records force cities to treat cyber resilience as basic infrastructure budgeting, the way Atlanta's prolonged recovery already signaled.
The trend: Ransomware is becoming a recurring operating condition for American local governments, spreading through leaked state-grade exploits and shared IT providers faster than cities can harden.