The recent cyber attacks against local governments have been concerning, with Cobb County in Georgia being targeted in March 2025 by a sophisticated ransomware attack. In an attempt to gain an edge over their competitors, the cybercriminals known as Qilin have claimed responsibility for a breach that resulted in the theft of approximately 150 gigabytes of sensitive data, totalling more than 400,000 files, and the unauthorised access to them.
An autopsy photograph, Social Security number, driver's license photo, and confidential internal government documents are among the materials that have been compromised. Public sector cybersecurity has been under increased scrutiny since this incident occurred, as officials attempt to assess the extent of the damage and prevent further exposures.
Cobb County School District has been informed that there has been an intrusion into the network and is currently collaborating with multiple cybersecurity partners to investigate the incident. This intrusion is considered a serious incident and is currently under active investigation. It has been reported that both the Georgia Emergency Management Agency and the Department of Homeland Security have been notified about the breach.
Throughout the investigation, the school system has advised all employees not to use desktop computers, and certain network processes are expected to be temporarily disrupted for the next few days as a precautionary measure, however, school operations are still expected to proceed as scheduled, despite these technical challenges.
It is anticipated that Advanced Placement (AP) testing will begin on Monday, May 5, and that the state Milestones Testing will be administered as scheduled on Tuesday. As of right now, there has been no indication that any personal informatio,- including information concerning students and employees, has been compromised, since the school remains operational and has not been affected by the breach. In addition, there is no indication that any personal information has been compromised.
The school system, however, is currently conducting a comprehensive investigation to assess the full scope and impact of the unauthorised access. At approximately 7:00 p.m. on Friday, the school system first discovered abnormal network activity. In line with established cybersecurity protocols, the IT department and its external security partners responded rapidly to the intrusion by shutting down affected systems, containing it, and identifying its source as soon as possible.
While the district's internal network remains restricted in the interim for forensic review to continue, and to ensure the security of critical systems is maintained, access is restricted to the district's internal network. As a result of the investigation, the school district has assured parents, staff, and community members that the district maintains close communication with federal, state, and local authorities. As more details come in, the district will provide regular updates to parents, staff, and the community.
A ransomware attack on Cobb County is still being investigated, with officials still trying to figure out the extent of the breach and identify individuals who might have been affected by the attack. Even though it is still unclear what type of data has been compromised, preliminary reports indicate that three county employees have been confirmed to have been compromised.
To combat this situation, the county has agreed to offer impacted residents access to credit monitoring services as well as identity theft protection services as a precautionary measure. Several online systems, including court records, jail databases, and Wi-Fi services, were closed down as a result of the cyberattack that was first discovered on March 21, prompting county officials to act immediately.
It appears that these systems have gradually been restored over the last few days, and that full functionality is reported to have been restored as of March 27.
County officials have been cautious in disclosing specific details regarding the nature of the compromise throughout this period.
They had until recently not confirmed whether ransom demands had been involved in the incident. It has been announced that Cobb County Communications Director Ross Cavitt addressed concerns about the server outages during a press conference held during the outages by stating that once all servers have been securely reconnected, residents will not experience any disruptions in accessing data or services.
As for whether the incident has been labelled as a ransomware attack, he refused to provide any further information on it. The Marietta Daily Journal has not been able to conduct an interview with county officials, which includes chairwoman Lisa Cupid and other members of staff, citing the sensitivity of the ongoing investigation as the reason for not doing so.
During a recent email message that was released by the Cobb County Communications Department, it was made clear that it would be premature to comment publicly on this matter while the investigation is still underway.
In the meantime, Commissioner Keli Gambrill expressed confidence in the county's response, pointing out that staff members are performing well under challenging circumstances, despite the situation.
Cybersecurity expert Allan Hudson confirmed in the aftermath of the ransomware attack that 16 files that were stolen from the data had already been published online by the attackers as a result of the ransomware attack in an apparent attempt to demonstrate how serious the breach was.
There were at least three autopsy photographs that were exposed, along with sensitive personal identification documents such as driver's licenses and social security cards that were also revealed.
Several additional records released by the county seem to be about private citizens, incarcerated individuals, as well as government employees, which raises serious security and privacy concerns for many individuals.
Authorities at Cobb County reported to the public in April that ten individuals had been formally informed that their data had been compromised as a result of the breach.
Hudson, however, emphasised that the extent of the breach is likely to be much wider than that, warning that anyone who has had an interaction with Cobb County government services in the past several years is at risk of experiencing a breach. He recommended that residents take immediate precautions to reduce their risk of identity theft by freezing their credit, updating their passwords, and enabling two-factor authentication across all of their online accounts.
Several county officials reiterated their position against negotiating with cybercriminals in an official statement.
Even though there may be difficult choices to make, the county refuses to support or enable criminal enterprises, even if faced with difficult choices. While this may not be comforting to those affected, standing firm sends the clear message that bad actors won't benefit from this crime at any cost."
Despite the growing concern that the ransomware group known as Qilin may continue to release sensitive information, this firm position comes at the same time that there are increasing concerns about this group's continued release of sensitive information.
Hudson described the group as highly aggressive and warned that more information could leak soon. Cobb County continues to encourage residents to monitor financial accounts and report any suspicious activity by staying vigilant.
The county is assisting those impacted by the cyberattack, including credit monitoring and identity theft protection services, as part of the county's ongoing mitigation efforts. In light of the ongoing investigation into the ransomware attack on Cobb County, the incident has served as a stark reminder of the growing threats that public institutions face as a result of cyberattacks.
Among the many implications of the breach, not only did it expose vulnerabilities in government systems, but it also made it clear that the implications for citizens whose personal data may be compromised could be far-reaching. As a significant amount of sensitive information has already been released, it is evident that there is an urgent need for heightened digital security at every level of local government.
The authorities are working closely with cybersecurity experts and federal agencies to contain the situation and prevent further compromise. Despite the initial steps taken by officials to offer identity protection and credit monitoring services, it will likely be the effectiveness and swiftness with which mitigation efforts are initiated that will determine the long-term impact of this breach.
Cobb County residents who have used Cobb County services in the past should be encouraged to take proactive measures to protect their personal information by doing so.
It is important to ensure that users' financial accounts are monitored, that multifactor authentication is enabled, and that their credit profile is frozen where needed. Especially when such cyberattacks are perpetrated by persistent and organised groups such as Qilin, it highlights how important awareness and resilience are at the community level.
As a result of this incident, the world, as well as government entities, industrial entities, and individuals, will be called upon to re-evaluate their approach to digital security, especially in a world where we are increasingly interconnected.
