City of Atlanta

Profile narrative

The City of Atlanta is a municipal government organisation headquartered in the United States, providing public administration and a broad range of civic services to its residents and the wider metropolitan community. As a city-level governmental body, it delivers essential local government functions such as billing and payment processing, court information access, and other public-facing applications that residents and businesses interact with on a regular basis. The organisation also oversees or coordinates with critical infrastructure areas including public safety services, water services, the municipal airport, and payroll operations, reflecting the wide operational scope typical of a major American city government. Online services delivered through digital platforms form a key part of how the city interacts with the public, encompassing web applications for utility payments, municipal court records, and other administrative functions that handle sensitive personal information submitted by residents.

The City of Atlanta's operational footprint includes a significant digital presence, with applications and services hosted on platforms such as Microsoft D365 customer relationship management and enterprise resource planning systems. During the March 2018 ransomware incident, the city's new chief operating officer confirmed that the attack affected both public-facing and internal applications, demonstrating the breadth of the organisation's digital estate. Atlanta collaborated with federal agencies and private sector partners including the FBI, the Department of Homeland Security, Microsoft, and Cisco in responding to that incident, which indicates the organisation engages with external technical and security resources as part of its operational and remediation practices. The organisation's regulatory and sector positioning is that of a public sector entity bound by governmental accountability, public records obligations, and obligations to protect citizen data, though specific departmental structures and budgets are not detailed in the available material.

Two notable cybersecurity incidents have been publicly linked to the City of Atlanta. The first, on 22 March 2018, involved a ransomware attack that encrypted data and disrupted online municipal services, with the malware identified as resembling the Samas ransomware strain and a ransom demand of approximately fifty-one thousand dollars reported by local media. Public safety, water services, the airport, and payroll systems were reported as unaffected, while applications for paying city bills and accessing court information suffered outages. The second incident, linked to research dated 7 August 2026, associated the City of Atlanta with a broader set of data leaks attributed to the extortion group ExfilSquad, where sensitive information was exfiltrated from Microsoft D365 environments through misconfigured Power Pages portals permitting public read access, rather than through a platform vulnerability. In that disclosure, the attackers noted the breaches stemmed from unauthorised read access to Dataverse exports, and the group's published releases included data attributed to multiple organisations, of which the City of Atlanta was one.

The City of Atlanta operates as an independent municipal government rather than as a subsidiary or branch of another organisation, with its leadership accountable to its residents through elected officials such as the mayor, who publicly communicated guidance following the 2018 incident urging individuals who had shared personal information with the city to monitor their accounts for suspicious activity. No parent company or corporate ownership structure applies, as the entity is a governmental body operating within the United States.

Incidents

2 incidents linked to this organisation.