Greene County, Georgia
Greene County cyber incident disrupts government services
Summary
A July ransomware attack shut down Greene County, Georgia, systems and disrupted payments and public requests. An Aug. 17 county notice confirmed copied data, potentially including employee identifiers, and said services had been restored; the exact recovery date remains unknown.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
DD-CIT assessment
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data impacts
-
Data theft or exfiltration
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Complete service outage
A primary service, system, platform, or operational capability became entirely unavailable.
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Transaction processing disruption
Business, financial, customer, administrative, or operational transactions could not be completed normally.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Backlog created
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
-
Customer or public access restricted
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
Extortion indicators
-
No known extortion indicator
Available evidence indicates that no extortion demand, threat, communication, or related pressure tactic was identified.
Incident narrative
Analyst assessment
Greene County, Georgia, confirmed that a July 9, 2026, ransomware attack affected its computer network. Its Aug. 17 employee notice also confirmed that attackers copied county data, potentially including employee Social Security and driver’s license numbers. The county was reviewing the affected files and people. This supersedes its preliminary July statement that it had found no evidence of access or exfiltration.
Operational significance
Our reporting documented a county network shutdown affecting payments and public-request processing across tax, court, administrative, elections, public works, recreation and other offices. The county’s technology provider disconnected servers for containment and rebuilding. The online tax-payment application still displayed an unavailability notice July 26.
The county said 911 communications and the sheriff’s office remained operational. The evidence does not establish interruption of emergency dispatch or core sheriff operations.
Recovery and current status
The Aug. 17 notice says the county restored services and recovered data from backups, but supplies no exact completion date. That retrospective statement supports ended operational effects. Operations are presumed resolved. July 26 remains the latest documented impact date; the later disclosure does not document a new outage.
Data impact and attribution
The county offered credit monitoring to employees while reviewing the copied information. Confirmed copying supports data theft or exfiltration; the specific information and affected population remain uncertain. The notice does not establish an actor identity, access method, malware family, ransom demand or payment.
Confidence and uncertainty
Confidence is high in ransomware involvement and copied county data because the county directly acknowledged both. Earlier uncertainty about those two findings is superseded. Availability effects are independently supported by the service shutdown and payment limitations. Specific encryption mechanics, compromised systems, affected-person totals and attribution remain unresolved.
Analytic gaps
The public record does not establish the intrusion start before July 9, access vector, complete compromised-system inventory, affected individual data elements, actor identity, extortion communications, payment or exact incident-wide restoration date.
Organizations involved
Impacted locations
Sources
DysruptionHub reported that Greene County took its network offline after discovering a July 9 cybersecurity incident, disrupting payments and request processing across tax, court, administrative, elections, public works, recreation, and other offices while 911 and the sheriff remained operational.
FOX 5 Atlanta reported that Greene County identified a cybersecurity incident on July 9, contractors disconnected servers to contain it, and emergency 911 dispatch and the sheriff’s department remained fully operational.
Greene County said it identified a cybersecurity incident July 9, took county servers offline through its contracted technology provider, notified law enforcement and was rebuilding systems. It reported no evidence of accessed or exfiltrated information and said 911 communications and the sheriff’s office remained operational. By August 3, the notice URL redirected to a county 404 page and was no longer listed publicly.
The county confirms a July 9 ransomware attack and copied county data, potentially including employee identifiers. Its Aug. 17 notice says services were restored and data recovered from backups; the affected population and exact restoration date remain unknown.
The Greene County Tax Commissioner’s contracted payment page displayed an online-tax-payment unavailability notice July 26. On August 3, the tax application instead reached its normal anti-bot verification gateway; CAPTCHA verification prevented testing the post-verification transaction flow.
The Greene County Tax Commissioner’s live website said residents could securely pay property taxes online and linked to the Government Window tax application on August 3, supporting an inference that the earlier payment outage had ended.
The official county website identifies Greene County government and its offices at 1034 Silver Drive in Greensboro, Georgia, and displayed the cybersecurity incident notice while the main website remained online.
See something that needs correction?
Signed-in members can report an error, update, or missing source.