Atlanta's $17M Ransomware Attack: What Could Have Stopped It

Key facts

Attack date: March 22, 2018, using SamSam ransomwareRansom demanded: roughly 51,000 US dollars in BitcoinRansom paid: none. The city refused to payFinal recovery cost: roughly 17 million US dollars, according to a city report reviewed by The Atlanta Journal-ConstitutionTwo Iranian nationals, Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri, were indicted by the US Department of Justice in November 2018 for developing and deploying SamSam

In March 2018, the SamSam ransomware attack on the city of Atlanta became one of the most expensive ransomware incidents ever to hit a US local government. It remains a useful case study in what happens when an organization has no way to detect, stop or recover from ransomware in real time.

On March 22, 2018, attackers used brute-force techniques to gain access to city networks and deployed SamSam, a ransomware strain the US Department of Justice later attributed to two Iranian nationals. More than a third of the city's 424 essential applications were affected, including roughly 30 percent that supported core municipal functions such as the court system and police department. The city attorney's office lost all but six of its 77 computers along with 10 years of documents, and the police department lost its stored dashcam recordings.

The attackers demanded roughly 51,000 US dollars in Bitcoin. Atlanta refused to pay.

Because the city had no reliable way to detect the attack early or recover cleanly, recovery ballooned into a multi-year, multi-million-dollar project. Early estimates put the cost at around 1 million US dollars. By June 2018 that had grown to 9.5 million US dollars, and a later city report put the total closer to 17 million US dollars once new hardware, forensics, consulting and security upgrades were included.

That gap between a five-figure ransom demand and an eight-figure recovery bill is a pattern that shows up again and again in ransomware incidents: the ransom is rarely the real cost. The real cost is what it takes to rebuild systems, restore data and recover trust without ever being certain attackers won't come back.

Atlanta didn't, and law enforcement guidance still generally recommends against it. The FBI states plainly that paying a ransom does not guarantee an organization will get its data back, and that payment can encourage attackers to target more victims. The Cybersecurity and Infrastructure Security Agency gives the same guidance across its ransomware advisories: payment does not guarantee recovery and may fund further attacks.

That guidance only works if an organization has a real way to recover without paying. Verizon's 2025 Data Breach Investigations Report found ransomware present in 44 percent of breaches analyzed that year, and 64 percent of victim organizations refused to pay, up from half two years earlier. The median ransom payment fell to 115,000 US dollars. Refusing to pay is increasingly the norm, but it only protects an organization if backups and recovery processes actually work.

Acronis Active Protection is an anti-ransomware technology built into Acronis Cyber Protect that uses behavioral detection rather than signature matching, meaning it looks for what ransomware does rather than checking files against a list of known threats. That distinction matters for attacks like SamSam, which spread through manual, human-operated techniques rather than mass-mailed malware, and which can otherwise slip past antivirus tools waiting for a known signature.

In practice, that means three things a city like Atlanta didn't have in March 2018:

• Real-time detection based on behavior, so an attack can be flagged as it starts encrypting files rather than after systems are already down.
• Automatic termination and rollback, so affected files can be restored to their pre-attack state without waiting on a ransom negotiation or a from-scratch rebuild.
• Regular, isolated backups, so even if an attack gets through, recovery does not depend on trusting the attacker to deliver a working decryption key.

None of this guarantees protection against every future ransomware variant. But it is the layer Atlanta was missing: a way to catch and reverse an attack within minutes rather than discover the damage after the fact and spend the next year rebuilding.

The clearest lesson is that ransomware readiness is not just a backup question or just a detection question. It is both. Backups without real-time detection mean an organization only finds out about an attack once it has already lost access to its systems. Detection without reliable backups means an organization can catch an attack but still faces a slow, expensive rebuild if recovery fails.

Atlanta's own report also pointed to a familiar root cause: a city auditor had flagged severe, unresolved vulnerabilities months before the attack. Prevention starts with basic hygiene like patching and credential management, but no organization eliminates every vulnerability, which is why detection and recovery capability matter just as much as prevention.

How much did the Atlanta ransomware attack cost? The city ultimately estimated recovery costs at roughly 17 million US dollars, far more than initial estimates, largely because of the scale of systems that needed to be rebuilt rather than simply restored.

Did Atlanta pay the SamSam ransom? No. The city refused to pay the roughly 51,000 US dollar Bitcoin demand and rebuilt its systems instead.

Who was behind the SamSam ransomware attacks? The US Department of Justice indicted two Iranian nationals, Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri, in November 2018 for developing and deploying SamSam ransomware against Atlanta and hundreds of other victims.

What is Acronis Active Protection? It is an anti-ransomware technology built into Acronis Cyber Protect that uses behavioral analysis and machine learning to detect ransomware activity in real time, rather than relying on known malware signatures, and can automatically terminate and roll back an in-progress attack.

Should organizations ever pay a ransomware ransom? The FBI and CISA both advise against it, since payment does not guarantee data recovery and can encourage further attacks. That guidance is easier to follow when an organization has reliable backups and detection already in place. For a deeper look at how ransomware families like SamSam operate, see the Acronis Global Cyber Threat Catalog.