BlackByte ransomware gang claimed attack on the City of Augusta, Georgia

The City of Augusta, Georgia, the state's third largest city, confirmed that an unauthorized party gained access to its computer systems beginning on May 21, 2023. The intrusion took city websites and internal systems offline and left several departments closed or operating on reduced hours, although officials said emergency services continued to run.

On May 25 the BlackByte ransomware group added Augusta to its extortion site and published roughly 10GB of files it said came from the city. Reviewing the sample, BleepingComputer reported that it contained payroll information, contact details, personally identifiable information, physical addresses, contracts and city budget allocation data. BleepingComputer wrote that the origin and authenticity of the leaked data had not been verified. The Register cautioned that cybercriminals are not always the most honest of folks and advised against taking them at their word.

BleepingComputer and Augusta broadcaster WRDW reported that BlackByte demanded $400,000 to delete the stolen files and offered to sell the data to a third party for $300,000. Mayor Garnett Johnson publicly disputed circulating reports of a $50 million demand and said the city was not in communication with the group.

Augusta's IT department said it was working to restore full functionality and to determine what data had been affected. City officials met with FBI agents and promised further updates. The investigation was continuing at the end of May 2023.