Skip to content
DysruptionHub
Sign in Subscribe

Cobb County cyberattack and data extortion

Summary

Cobb County logo

Cobb County took servers offline March 21, 2025, after detecting unauthorized activity. Court filing, payments, records access and online scheduling were disrupted, with paper and telephone alternatives. Later findings established file access and copying March 6–21. Systems and partner connections were restored, and the county confirmed refusing a ransom demand. Qilin claimed responsibility, but attribution, encryption and the precise final recovery date remain unverified.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High
Ransomware:
Unresolved
Attribution:
Unresolved

Attack mechanisms

  • Data extortion

    Threats to publish or sell stolen data without evidence of encryption.

  • Unauthorized access

    Unauthorized access to systems, accounts, networks, or data.

Data impacts

  • Data theft or exfiltration

    Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Email disruption

    Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.

  • Online portal unavailable

    A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Payment processing disruption

    The organization could not process, receive, issue, reconcile, or record payments normally.

  • Records access disruption

    Staff, customers, patients, students, residents, or other users could not access records or case information normally.

  • Records processing disruption

    The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.

  • Scheduling disruption

    Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.

  • Government services disrupted

    Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

  • Alternate service channel required

    The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.

Extortion indicators

  • Ransom demand

    The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.

  • Data-theft extortion

    The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.

  • Public leak threat

    The actor explicitly threatened to publish or publicly release victim data or incident details.

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

  • Data sample published

    The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.

  • Countdown or payment deadline

    The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.

  • Payment denied

    An authoritative source stated that no ransom or extortion payment was made.

Incident narrative

Analyst assessment

A cyberattack against Cobb County government caused a shutdown of county servers and interrupted online public services beginning March 21, 2025. The county’s later official breach notice established that an unauthorized actor accessed and copied files between March 6 and March 21. That access period began before the operational disruption; it does not establish that public services were unavailable throughout those two weeks.

Initial notices described maintenance and unusual activity. On March 24, The Atlanta Journal-Constitution attributed possible outside hacking activity to a county spokesman. At a March 26 press conference, officials confirmed an unauthorized user had been detected, while data exposure and ransomware remained under investigation.

Operational significance

The county’s March 24 newsletter documented server outages, delayed email, limits on electronic court filing and non-cash payments, and telephone scheduling for building inspections. Offices and courts remained open; the website, bill payment services and phone system were operating normally by that update. Atlanta News First also documented unavailable online senior-program scheduling, paratransit reservations and court-record access, with telephone assistance available.

FOX 5 Atlanta reported courthouse staff using paper records and residents encountering problems with virtual court access. The reporting also described a juror’s account of impaired building cooling. These effects do not establish closure of the courthouse, suspension of all court business or a countywide communications outage.

Recovery proceeded in stages. Although later reporting put initial server restoration on March 27, the Cobb Courier’s March 30 report quoted a county spokesman saying servers went down again March 28 and full functionality returned March 29, with possible further weekend interruptions. By April 24, the county said its systems were operational and vendors and partners had reconnected. The incident is resolved, but the precise final end date is unverified.

Confidence and uncertainty

Confidence is high in cyber involvement, operational disruption and unauthorized file copying because county statements establish each. The April 24 disclosure identified 10 initially affected people, including three employees; this was an initial notification count, not a verified final total. The May notice identified potentially involved personal and financial information and said there was no indication of misuse at that time.

Qilin claimed responsibility May 1, alleging theft of more than 150 gigabytes. A county statement reported May 2 confirmed a ransom demand and refusal to pay, while declining to validate the leak allegations. The claim and reported samples support an extortion assessment; they do not establish Qilin’s responsibility, the authenticity or full volume of the alleged files, or encryption of county systems.

Analytic gaps

The entry method, precise intrusion time, final number of affected people and complete restoration chronology remain unresolved. A ransom demand and a ransomware group’s listing do not, by themselves, demonstrate encryption. The available evidence does not identify an authoritative final recovery date or validate the group’s full data claims.

Threat actor and claim

Qilin

Listed as: cobbcountySource: ransomware.livePublished: Discovered:

Claim details

Qilin listed the county’s historical cobbcounty.org domain as an alleged victim. Comparitech’s original report independently dates the listing to May 1, 2025; the tracker discovery timestamp is recorded separately. The group alleged more than 150 GB and threatened publication. May 2 reporting attributes descriptions of samples and 400,000 files to an outside expert; the county explicitly declined to verify those allegations. County disclosures separately confirm unauthorized file copying and a refused ransom demand. They do not confirm Qilin’s responsibility, the full file volume, sample authenticity or encryption.

Organizations involved

Impacted locations

  • Cobb County, Georgia

    Cobb County government serves the geographic county. The official Board of Commissioners page describes the commission-county manager government, while the official May 23 incident notice identifies the affected county government. Pair its county service remit with the incident affected-area relationship. This overlay identifies jurisdiction and affected public services; it does not assert every resident, municipality, department or physical site experienced an outage.

    Source

  • Marietta, Georgia

    The county’s official Board of Commissioners, contact directory and incident notice identify administrative offices at 100 Cherokee Street, Marietta. An exact Census street-address match confirms Marietta city (1349756), Cobb County (13067); the geocoder normalizes ZIP 30060 while the official mailing address uses 30090. Retain the existing Marietta municipality and county/state/country parent chain. This is the affected government’s physical site context, not a citywide municipal-government outage.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.