A ransomware incident that occurred Aug. 1 affected computer systems in Norcross, Georgia, where restoration and an investigation remained underway Monday, city officials said.
Norcross said most city systems and services were operational but did not identify the affected departments, applications or public-facing services in its public notice.
Norcross disclosed the incident Friday, 27 days after Aug. 1. The city has not said when officials discovered the ransomware or explained the timing of the disclosure.
Norcross said it engaged outside cybersecurity professionals and notified law enforcement after detecting the incident. In an email Monday, Community Relations Manager Julie Brechbill said the city was not in a position to discuss specific affected systems, investigative findings or details beyond its public statement while the investigation continued. Norcross has not identified the law enforcement agencies involved.
Chip in once
If this reporting helped you, a one-time tip helps cover hosting, tools and future investigations.
Support us monthly
A small monthly pledge keeps independent coverage and our reader tools online for everyone.
Officials have not said whether files were encrypted or whether resident, employee or municipal information was accessed or copied. They also have not identified a ransom demand, payment, ransomware operation or other responsible actor. A DysruptionHub search found no public claim of responsibility from a ransomware or extortion group as of Monday.
Norcross, a Gwinnett County city about 15 miles northeast of Atlanta, had an estimated population of 19,086 in 2025, according to the U.S. Census Bureau.
Another Georgia city, Acworth, disclosed a cybersecurity incident in June after warning of possible network-related service interruptions. Acworth did not identify the affected services or confirm ransomware but said 10 days after the incident that all systems had been restored.
Brechbill said the city remained focused on safely restoring affected systems and would release more information as appropriate. She did not provide a timeline for completing the restoration or investigation.
