Less than a week after ransomware victim Riviera City paid ~$600K, another Florida town, Lake City, votes to pay ~$500K in BTC to ransomware hackers
Lake City officials give in and agree to pay nearly $500,000 to ransomware gang. — Less than a week after a first Florida city agreed …
Context & Ripple Effects
Two Florida cities have now paid ransomware gangs within a single week: Riviera City's council voted to pay ~$600K to hackers who had encrypted its records and disabled email for three weeks, and Lake City has followed with a ~$500K Bitcoin payment of its own. The precedent that looms over both votes is Atlanta, which refused clarity on its ~$50K ransom demand and instead spent ~$2.6M on recovery — a comparison city councils are clearly weighing when they choose to pay.
First-order effects
- Lake City regains access to systems encrypted by the gang, at the cost of roughly half a million dollars in cryptocurrency paid directly to attackers.
- The gang behind both Florida attacks now has demonstrated proof that small-city councils will pay six-figure ransoms within days of an encryption event.
Second-order effects
- Peer cities facing similar attacks lose the argument for refusing payment: with two Florida precedents on record, holding out looks like choosing Atlanta-style multi-million-dollar recovery bills over a smaller ransom.
- Attackers gain a repeatable playbook — encrypt municipal records, wait out the council, collect in BTC — making local governments a proven target class rather than opportunistic victims.
Third-order effects
- If the pay-quickly pattern holds, ransomware economics shift structurally toward public-sector targets: municipalities become priced-in revenue streams, forcing state-level policy on backup mandates, cyber insurance, and whether paying ransoms should even be legal.
- The payment itself buys no operational certainty — as later incidents would show, decryptor tools can be slow or incomplete, so the real structural fix is offline backup discipline, not ransom budgets.
The trend: US local governments are normalizing ransom payment as incident response, converting municipal IT weakness into a reliable criminal revenue model.