Forest Park, Georgia, investigated malicious access to its information technology network in July 2024. Later city statements described disruption to a limited number of systems and possible access to personal information.
Analyst assessment
The city’s initial statement says it learned of malicious network access on July 22 and quickly isolated the intrusion. FOX 5’s July 25 report independently relays the city’s account. A later notification, reported by The Atlanta Journal-Constitution, places a limited-system disruption around July 24. Detection and disruption are distinct observations; these accounts do not establish one exact intrusion start.
Operational significance
The later city account establishes a bounded municipal IT disruption. The original statement said municipal departments, including police, fire and public works, remained fully operational and public safety was unaffected. The available reporting does not identify the affected applications, the outage duration or a citywide service shutdown.
Officials secured the network and worked with law enforcement and a digital forensics firm. The historical operational incident remains presumed resolved, with no verified exact date when every affected function returned.
Confidence and uncertainty
Confidence in malicious network access and limited-system disruption is high. The initial assessment that sensitive documents had not been compromised was preliminary. By March 10, 2025, officials determined that some personal information may have been accessed; the April notification supersedes the earlier assessment without establishing the precise extent of access or copying.
The city identified names combined with one or more potentially affected identifiers, including Social Security, driver’s license, passport or state identification information and birth dates. Those categories do not establish that every notified person had all such information involved. Officials described people with various relationships to the city, declined to provide a count and reported no indication of misuse at that time.
Ransomware.live’s domain listing records a Monti claim discovered July 24, 2024. Later city-name listings include an October entry labeled Full Leak. These are tracked allegations; they do not independently authenticate stolen files, prove encryption or establish a separate intrusion for each listing. Tracker discovery is distinct from the unknown original post publication time.
Analytic gaps
The precise access and outage timeline, affected systems, complete-restoration date, actual data access or copying, affected-person count, any ransom demand or payment, and independently verified Monti responsibility remain unresolved.
