Macon-Bibb County
Macon-Bibb County cyberattack
Summary
Macon-Bibb County shut down its network after suspicious activity on May 11, 2024. Communications and web services returned in stages, but some online resources and sheriff’s reports remained inaccessible in June, while courts used manual processes.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
-
Email disruption
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Website unavailable
A public-facing website was unavailable, disabled, or inaccessible.
-
Remote access disruption
VPN, remote desktop, telework, remote administration, or other remote-access capabilities were unavailable or restricted.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Transaction processing disruption
Business, financial, customer, administrative, or operational transactions could not be completed normally.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Backlog created
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Macon-Bibb County, Georgia, shut down its network after detecting suspicious server activity on May 11, 2024. Contemporary StateScoop reporting reproduces the county’s acknowledgment of a potential breach and its request for state and federal assistance.
Analyst assessment
The county’s acknowledgment, protective shutdown and documented service effects establish a disruptive cyber incident. Officials later explicitly described an attack. The technical attack mechanism, initial entry method, responsible actor and ransomware involvement remain unestablished.
Operational significance
Local reporting updated through May 17 documents disrupted payments, reservations, vehicle transactions and service requests. Courts accepted exact-amount money orders in person, and residents used telephone contact for service requests.
The county’s May 17 recovery bulletin confirms staged restoration: communications returned by May 15, vehicle-title and tag transactions on May 16, and about 90% of department web pages by May 17. Property-tax, solid-waste and court-payment functions still had limitations at that checkpoint, while procurement deadlines were postponed.
A courthouse recovery notice from SAS Data Retrieval reports restored court and clerk communications. The vendor’s narrower account does not establish recovery across all county departments.
June 24 reporting found continuing web and sheriff-record access problems and outstanding vendor payments. Courts continued using manual processes. State voter-system access had been cut off until replacement laptops were supplied; this does not establish compromise of voting equipment. Officials said employee paychecks had continued.
Confidence and uncertainty
Confidence in cyber involvement and material municipal disruption is high. Last observed impact is June 24; the evidence does not show that every listed service remained unavailable for that entire period. Earlier communications and website recovery were partial milestones.
The historical incident remains presumed resolved, with no verified exact overall restoration date. The cited evidence does not establish stolen-data scope, a ransom demand or a payment. A separate 2014 incident is excluded.
Analytic gaps
The first intrusion date, technical access path, complete affected-system inventory, final data findings and date all records and payment functions recovered remain unresolved.
Organizations involved
Impacted locations
Bibb County, Georgia
The affected consolidated government’s offices at 700 Poplar Street in Macon are in Bibb County. This physical county link complements the Macon office link and the separate county service-area overlay.
Bibb County is the geographic remit of the affected consolidated government. Reported effects reached county records, courts, vendor payments and elections administration. The area link represents that government’s service geography, without asserting that every resident, office or service was disrupted.
Macon, Georgia
Macon is the affected government’s primary physical anchor. Its City Hall is at 700 Poplar Street. Reporting documents government network and communications interruptions; this link identifies the government’s location without asserting a separate attack on the building or disruption of every city service.
Sources
Macon-Bibb took its network offline after a possible breach; email and landline service remained unreliable on May 13.
Communications and website access returned in stages, while payments and procurement remained affected in the May 17 update.
The county reports partial communications and website recovery, with payment limits and postponed procurement deadlines still in place.
County records and web access problems continued in June; courts used manual processes and vendor payments remained outstanding.
A courthouse-services vendor reports restored court and clerk communications, while forecasting completion of its own backlog.
See something that needs correction?
Signed-in members can report an error, update, or missing source.