Ransomware encrypts all three servers at George County, Mississippi

George County, a coastal county in Mississippi, spent much of July 2023 rebuilding its systems after ransomware encrypted its entire server estate.

County officials said the attack began on July 15, 2023, when an employee clicked a link in a phishing email that imitated a routine system update notice. The attackers then moved between machines until they obtained an administrative account, which opened up the wider network. All three of the county's servers and nearly every networked office computer were encrypted.

A ransom note was found days later in a file named Restore. It carried a Bitcoin wallet address and a five day deadline but did not identify the group behind it. Officials declined to disclose the amount demanded, and the board of supervisors voted against paying, citing both the cost and doubt that payment would restore anything.

The county contacted the FBI and worked with the Department of Homeland Security, the sheriff's department and several state agencies. Supervisors declared a local emergency so outside IT help could be hired without going through normal bidding rules. A backup taken the day before the attack allowed reconstruction to begin, and the county expanded its IT staff from one person to four working long shifts.

One server was fully restored by July 19 and a second was partially restored the following day. One county official likened the disruption to a digital hurricane.