This guide brings together and replaces our earlier news posts on ransomware attacks against cities, counties, schools, courts and transit agencies (2019 to 2024), rewritten and expanded in October 2026 as a sourced reference.
When ransomware hits a company, customers are inconvenienced. When it hits a city, a county or a school district, people cannot pay a water bill, record a house sale, file a court document, renew a car registration or go to class. Public bodies run services that cannot simply close for a few weeks, and attackers know it. The security firm Emsisoft counted 113 U.S. state and municipal governments and agencies hit by ransomware in 2019, along with up to 1,233 individual schools, according to MIT Technology Review's summary of its year-end report.
The damage is measured in weeks and months, not hours. A 2022 Government Accountability Office report, cited by the White House in 2023, found that lost learning after a school cyberattack ranged from three days to three weeks, and full recovery took two to nine months. The nine cases below, from Baltimore in 2019 to Washington State's courts in late 2024, show how these attacks unfold, what they cost, and what the organizations involved did next. Each section sticks to what officials and major outlets reported. Where an attacker claimed responsibility, we say who made the claim and whether it was confirmed.
In this guide
- Timeline and at-a-glance table
- Baltimore, May 2019: RobbinHood and an $18 million recovery
- U.S. schools, 2019: the first big wave against education
- Stanford University public safety department, 2023
- Washington County, Pennsylvania, January 2024: the county that paid
- Kansas City Area Transportation Authority, January 2024
- Fulton County, Georgia, January 2024: LockBit and the refusal to pay
- Freehold Township, New Jersey, schools, January 2024
- Hamilton, Ontario, February 2024: an $18.3 million bill
- Washington State courts, November 2024
- What the cases have in common
- What this means for residents and for organizations
- FAQ
Timeline and at-a-glance table
Cases are listed in the order the attacks began. Some were made public months later.
- May 7, 2019
RobbinHood ransomware hits Baltimore city government. The city refuses to pay. - 2019 (full year)
Emsisoft counts 113 U.S. governments and up to 1,233 schools affected by ransomware. - May 12 to Sept. 27, 2023
Attackers are inside Stanford's Department of Public Safety network. Akira later claims the attack. - Jan. 19 to 24, 2024
Washington County, Pennsylvania, detects an intrusion that becomes a ransomware attack and shuts down its servers. - Jan. 23, 2024
Kansas City Area Transportation Authority (KCATA) phone systems go down. Medusa claims the attack and demands $2 million. - Weekend of Jan. 27, 2024
Fulton County, Georgia, loses phones, court filing and tax systems. LockBit claims the attack. - Jan. 29, 2024
Eight Freehold Township, New Jersey, schools close for a day after a cybersecurity incident. - Feb. 6, 2024
Washington County commissioners vote 2 to 1 to pay; about $346,687 goes to the attackers. - Feb. 20, 2024
U.S. and U.K. authorities seize LockBit's leak sites. - Feb. 25, 2024
Hamilton, Ontario, is hit by ransomware. It refuses an $18.5 million demand. - March 11, 2024
Stanford announces that data on more than 27,000 people was taken. - May 7, 2024
U.S. prosecutors announce charges against the alleged LockBit administrator. - Early Nov. 2024
Washington State's court network is taken offline after "unauthorized activity." Systems return Nov. 17. - July 30, 2025
Hamilton reports $18.3 million in costs and confirms its insurer denied the claim.
| Case | Sector | Who claimed it | Ransom outcome | Reported impact |
|---|---|---|---|---|
| Baltimore (2019) | City government | RobbinHood ransomware (no public claim) | Refused 13 bitcoin demand | About $18 million estimated; recovery into September 2019 |
| U.S. schools (2019) | K-12 education | Various groups | Varied by district | Up to 1,233 schools affected (Emsisoft) |
| Stanford DPS (2023) | University public safety | Akira (claimed) | Not disclosed | Data on 27,000+ people; 430 GB claimed |
| Washington County, Pa. (2024) | County government | Not publicly named | Paid about $346,687 | Servers shut down; sensitive data taken |
| KCATA (2024) | Public transit | Medusa (claimed) | $2 million demanded; outcome not disclosed | Call centers and landlines down; buses kept running |
| Fulton County, Ga. (2024) | County government | LockBit (claimed) | Refused | Weeks of disruption to courts, tax and phones |
| Freehold Township, N.J. (2024) | K-12 education | Not publicly named | Not disclosed | Eight schools closed for one day |
| Hamilton, Ont. (2024) | City government | Not publicly named | Refused about $18.5 million demand | CA$18.3 million cost; about 80% of network disabled |
| Washington courts (2024) | State courts | No attribution | No ransom reported | Statewide court systems offline about two weeks |
Dollar figures are in U.S. dollars except Hamilton, which reported in Canadian dollars. "Claimed" means the group said it was responsible; it does not mean investigators confirmed it.
Baltimore, May 2019: RobbinHood and an $18 million recovery
What happened. On May 7, 2019, ransomware known as RobbinHood spread through most of Baltimore's city government computers. Staff took every server offline except those running essential services. Baltimore was among the first big targets of the new strain; Greenville, North Carolina, had been hit by it the month before. The ransom note asked for 13 bitcoin, then worth roughly $76,000, and threatened that the price would rise after four days and the data would be lost after ten.
Impact. City email went down, along with the systems used to take card payments, check for outstanding liens and debts, and process property transfers. That last one stalled real estate sales across the city. Mayor Bernard "Jack" Young's office estimated the total cost at about $18 million: roughly $10 million to respond and rebuild, and about $8 million in revenue lost or delayed while the city could not process payments.
Response. City officials refused to pay. Reports at the time said the FBI had advised against paying. Employees improvised with stand-in Gmail accounts while systems were rebuilt, which Google briefly blocked before restoring them.
What happened next. Recovery stretched into September 2019. The city's IT leadership was criticized for not having a written disaster recovery plan, and the IT director was placed on leave that September and later left the post. The FBI reportedly told the city that paying would not have reduced those costs, because systems have to be cleaned and rebuilt either way.
U.S. schools, 2019: the first big wave against education
What happened. During 2019, ransomware moved from an occasional problem for schools to a regular one. Security firms published running tallies through the year, and education featured heavily in them. School districts were attractive for the same reasons as cities: they hold sensitive records about children and staff, often run older systems, have small IT teams, and face strong pressure to reopen quickly.
Impact. Emsisoft's year-end count found that ransomware affected up to 1,233 individual U.S. schools in 2019, as well as 764 healthcare providers and 113 government bodies. It put the potential total cost of ransomware in the U.S. that year at more than $7.5 billion, though MIT Technology Review noted that such cost estimates are very uncertain.
Response. Most districts called in outside incident-response firms and their insurers. Federal attention came later. In August 2023, the White House held its first summit on school cybersecurity. It said that during the 2022 to 2023 school year at least eight K-12 districts suffered significant cyberattacks, and four of them had to cancel classes or close. It also cited Government Accountability Office findings that districts lost between $50,000 and $1 million per incident.
What happened next. The 2023 announcements included a commitment from the Cybersecurity and Infrastructure Security Agency (CISA) to provide assessments, exercises and training to 300 additional K-12 organizations, a proposed Federal Communications Commission pilot of up to $200 million over three years for school and library cybersecurity, and a new Department of Education coordinating council.
Stanford University public safety department, 2023
What happened. Attackers were inside the network of the Stanford University Department of Public Safety (SUDPS) from May 12 to September 27, 2023, about four and a half months. The Akira ransomware group later claimed the attack and said it had stolen 430 gigabytes of data. Stanford said the intrusion did not reach university systems beyond the public safety department's network.
Impact. On March 11, 2024, Stanford said personal information on more than 27,000 people had been taken. For most of them, the exposed data could include dates of birth, Social Security numbers, passport and driver's license numbers and other government IDs. For a smaller group, it also included biometric data, health information, usernames and passwords, security questions, digital signatures and credit card details including security codes.
Response. Stanford filed breach notices with state regulators, including Maine's attorney general, and explained that the investigation had taken time to complete. Affected people were offered two years of free identity protection.
What happened next. As The Record noted, roughly ten months passed between the start of the intrusion and notification. That is a common pattern: working out exactly whose data was in stolen files can take months. Akira itself became one of the more active groups of the period. A joint advisory from CISA, the FBI and international partners in April 2024 said Akira had affected more than 250 organizations in North America, Europe and Australia and claimed about $42 million in ransom proceeds as of January 1, 2024.
Washington County, Pennsylvania, January 2024: the county that paid
What happened. Washington County, south of Pittsburgh, first noticed an intruder in its network on January 19, 2024. Five days later the intrusion became a full ransomware attack, and on January 24, after a warning from CISA, the county shut down its servers.
Impact. On February 5, the forensic firm Sylint confirmed that the attackers had taken large amounts of sensitive data, including information about children involved in the court system. The attackers set a deadline of 3:30 p.m. on February 6 for payment.
Response. At an emergency meeting on February 6, the county commission voted 2 to 1 to pay. The county authorized about $350,000: $346,687 went to the attackers, described only as suspected Russian hackers, and the Chicago firm DigitalMint, which handled the cryptocurrency transfer, charged a $19,313 fee. The county solicitor said paying "was not the county's first choice" but was the best option after weighing everything.
What happened next. The payment became public on February 15, 2024. It is the counterpoint to Baltimore, Fulton County and Hamilton, which all refused, and it went against the FBI's advice that victims should not pay.
Kansas City Area Transportation Authority, January 2024
What happened. Early on Tuesday, January 23, 2024, ransomware hit the Kansas City Area Transportation Authority (KCATA), the two-state agency that runs public transit across seven counties in Missouri and Kansas. KCATA operates 78 bus routes and six MetroFlex on-demand routes with about 300 buses and reports around 10.5 million riders a year. It disclosed the attack the next day.
Impact. The attack knocked out KCATA's communication systems. Regional RideKC call centers could not take calls and agency landlines stopped working. Riders of the Freedom and Freedom-On-Demand paratransit services, who book trips by phone, were given alternative numbers. Buses, paratransit and the online schedules kept running.
Response. On January 27, the Medusa ransomware group listed KCATA on its leak site, posted samples of what it said was KCATA data, and demanded $2 million, with ten days to negotiate. It also offered to delay publication for $100,000 per day. KCATA did not say publicly whether any rider or pass-holder data was involved, and its response to the demand was not disclosed.
What happened next. Medusa kept growing. In March 2025, CISA and the FBI issued a joint advisory saying the group had hit more than 300 victims in critical sectors including medical, education, legal, insurance, technology and manufacturing by February 2025. Its advice applies to every case here: patch promptly, require multifactor authentication for all services, and segment networks.
Fulton County, Georgia, January 2024: LockBit and the refusal to pay
What happened. Over the weekend of January 27, 2024, a cyberattack disrupted Fulton County, Georgia, the state's most populous county and home to most of Atlanta. The LockBit ransomware group later claimed responsibility, threatened to leak residents' data, and claimed to hold records related to the county's criminal case against former president Donald Trump.
Impact. Office phone lines, online bill payment, property records, court e-filing, marriage certificates, firearm permits, vehicle registrations and police incident reports were all affected. The sheriff's office switched to paper forms for jail records. By late February, county email was back, more than half of phone lines worked, and water bills could be paid again, but property tax payments were still down. The District Attorney's office said the election case material was kept on a separate system that was not hacked, and security analysts quoted by the Associated Press doubted LockBit's claim about those records.
Response. The county refused to pay. "We have not paid any ransom nor has any ransom been paid on our behalf," Board of Commissioners Chairman Robb Pitts said as LockBit's deadline passed at the end of February without the data being released. County officials later said a single wrong click by an employee had let the attackers in, and that the county had since spent millions strengthening its IT security.
What happened next. On February 20, 2024, U.S. and U.K. authorities seized LockBit's leak sites and infrastructure in an operation that included arrests overseas. In May 2024, U.S. prosecutors in New Jersey unsealed a 26-count indictment of a Russian national, Dmitry Khoroshev, alleging that he created and ran LockBit. The Justice Department said LockBit had more than 2,500 victims and extracted at least $500 million in ransoms. The State Department offered a reward of up to $10 million for information about him. The charges are allegations. Fulton County leaders said the group never published the sensitive data it threatened to release.
Freehold Township, New Jersey, schools, January 2024
What happened. Late on Sunday, January 28, 2024, the Freehold Township School District told families that all of its schools would close the next day because of "a cybersecurity issue."
Impact. Eight schools were closed on Monday, January 29. The district did not say what kind of incident it was, and it has not been publicly confirmed as ransomware. While systems were being restored, staff email was unavailable and the district communicated by phone.
Response. Schools reopened on Tuesday, January 30. The superintendent said the first phase of restoring computer systems was complete, but technology access would stay limited to contain the incident, and students were told to leave school-issued Chromebooks at home. The FBI said it was aware of the incident. Parents raised the obvious question of whether children's personal information had been exposed, which the district had not answered at the time.
What happened next. A one-day closure is a far better outcome than many districts have had. It still shows how much daily school operations depend on networks, and why the 2023 federal measures focused on training and exercises for districts with small IT teams.
Hamilton, Ontario, February 2024: an $18.3 million bill
What happened. On the evening of Sunday, February 25, 2024, the City of Hamilton, Ontario, learned that its systems had been hit. The city later confirmed it was a ransomware attack and that its systems had been encrypted. The attackers disabled close to 80% of the city's network.
Impact. Many city services were disrupted or ran in modified form for months, while critical programs continued. The city's forensic work found no evidence that personal or health information was compromised. Seven systems could not be recovered at all and had to be replaced, including the finance and business management suite, development and permit applications, fire department records management, the public health inspection app, traffic signal management, museum collections management, and the utility locates application.
Response. The attackers demanded about $18.5 million for a decryption tool. Hamilton refused, saying payment would have increased its "risk and financial exposure." It contained the incident and focused on recovery, restoration and rebuilding.
What happened next. A staff report presented on July 30, 2025, put the cost at $18.3 million, with more than $14 million going to outside experts. The city's cyber insurer denied the claim because multifactor authentication had not been fully implemented for online services when the attack happened, and an independent review found the denial consistent with the policy. Hamilton taxpayers are covering the full cost.
Washington State courts, November 2024
What happened. In the first days of November 2024, Washington's Administrative Office of the Courts (AOC) said it had identified "unauthorized activity" on the Washington Courts network. It took systems offline to secure them. An AOC associate director told the Seattle Times this was done "in an abundance of caution," and said officials had no reason to believe it was a targeted attack.
Impact. Courts across the state were affected to different degrees. Municipal and district courts that rely on the state's case management systems were hit hardest, while King County courts, which run their own systems, saw less disruption. Pierce County's clerk could not search electronic court records or show balances owed on judgments and fines. The outage also reached systems that depend on court data, including the State Patrol's firearm background check system, the Department of Licensing and the appellate court document portal.
Response. Clerk's offices such as Pierce County's stayed open during regular hours, and the AOC restored services in stages while posting status updates on its public channels.
What happened next. Core systems came back at 1 p.m. on Sunday, November 17, 2024. The firearm check backlog showed the knock-on effect: about 6,500 checks were completed in the first eight hours, against a typical volume of about 700 a day. Some services, including appellate e-filing, took longer. The AOC said it had detected no data breach and no ransomware, and it did not publicly attribute the activity. Even so, a precautionary shutdown of shared systems stalled courts statewide for two weeks.
What the cases have in common
- Stealing data is now the main lever. Baltimore in 2019 was mostly about encrypted files. By 2023 and 2024, Akira, Medusa and LockBit all threatened to publish stolen data, which puts pressure on victims even if they can restore from backups.
- Phones and email go first. In Kansas City, Fulton County, Freehold Township and Hamilton, the earliest visible effect was that people could not call or email. That makes it harder to tell the public what is happening.
- Paper still works. Fulton County's sheriff's office switched to paper forms, and Washington State's clerks kept counters open without their usual systems. Manual fallbacks keep essential services going while systems are rebuilt.
- Recovery costs dwarf ransom demands. Baltimore refused a demand of about $76,000 and spent about $18 million. Hamilton refused about $18.5 million and spent $18.3 million. The bill is mostly for rebuilding, which is needed whether or not anyone pays.
- Basic controls decide outcomes. Hamilton's insurance denial over multifactor authentication and Fulton County's "single wrong click" are reminders that most of these incidents start with ordinary weaknesses, not exotic exploits.
What this means for residents and for organizations
If you live in, study at, or work with an affected organization
- Get information from official channels. Use the city, district or court's main website and verified social accounts. Attackers and opportunists sometimes send fake "update" emails during an outage.
- Treat unexpected messages about the incident as suspect. Do not pay anyone who contacts you claiming to hold your data, and do not click links in messages about the attack. Report extortion attempts to local police and to the FBI's Internet Crime Complaint Center (IC3).
- Use the protection you are offered. If you receive a breach letter, as Stanford's affected people did, enroll in the free identity monitoring and read which data types were involved.
- Freeze your credit if your Social Security number was exposed. A credit freeze at each of the three U.S. credit bureaus is free and blocks most new-account fraud. Thaw it temporarily when you need to apply for credit.
If you run IT for a public body or a small organization
- Turn on multifactor authentication everywhere, especially for remote access, email and administrator accounts. Hamilton's case shows that insurers check.
- Keep offline, tested backups. Backups that the attacker can reach can be encrypted too. Test a full restore, not just a file.
- Patch internet-facing systems quickly and segment your network, as the CISA advisories on Akira and Medusa recommend.
- Write down and rehearse manual fallbacks. Decide in advance how you will take payments, run court dockets or dispatch services on paper, and how you will reach staff and the public when phones and email are down.
- Decide your ransom policy before you need it. Work out with legal counsel, insurers and elected officials how a payment decision would be made. Washington County had to decide in a single emergency meeting.
- Use free public help. CISA has committed to assessments, exercises and training for K-12 organizations, and reporting to the FBI early can bring useful intelligence about the group involved.
FAQ
Why do attackers target cities, schools and courts?
Public bodies hold sensitive records, often run older systems with small IT teams, and face intense pressure to restore services quickly. Attackers treat that pressure as leverage.
Should a government ever pay a ransom?
The FBI advises against it, because payment funds future attacks and does not guarantee data deletion or working decryption. Most cases here refused, including Baltimore, Fulton County and Hamilton. Washington County paid after concluding the risk to stolen records about children outweighed those concerns. Either way, the bulk of the cost is usually the rebuild.
What is ransomware-as-a-service?
Many groups, including LockBit, Medusa and Akira, rent their malware and leak sites to "affiliates" who carry out the break-ins. The developers take a cut. U.S. prosecutors allege that LockBit's administrator typically received about 20% of each ransom. This model is why one group's name can appear across hundreds of unrelated victims.
Was my personal data exposed in one of these incidents?
It depends on the case. Stanford confirmed data on more than 27,000 people was taken, and Washington County's forensic firm confirmed sensitive data theft. Hamilton found no evidence personal data was compromised, and Washington's courts reported no data breach. If you were affected by a confirmed breach, you should have received a notification letter.
Sources
- Wikipedia: 2019 Baltimore ransomware attack
- Engadget: Baltimore ransomware attack will cost the city over $18 million (June 2019)
- Bitdefender: Baltimore struggles to rebuild systems after refusing to pay bitcoin ransom (May 2019)
- MIT Technology Review: Ransomware may have cost the US more than $7.5 billion in 2019
- The White House (archived): New efforts to strengthen K-12 schools' cybersecurity (Aug. 2023)
- The Record: Stanford data leaked in Akira ransomware attack (March 2024)
- American Hospital Association: Joint advisory on Akira ransomware (April 2024)
- The Record: Pennsylvania county pays ransom after cyberattack (Feb. 2024)
- BleepingComputer: Kansas public transportation authority hit by ransomware (Jan. 2024)
- TechRepublic: FBI and CISA advisory on Medusa ransomware (March 2025)
- SecurityWeek/AP: Georgia's largest county is still repairing damage from January cyberattack (March 2024)
- Atlanta News First: State Department offers $10M reward for information on Fulton ransomware suspect (Dec. 2024)
- KrebsOnSecurity: Feds seize LockBit ransomware websites (Feb. 2024)
- KrebsOnSecurity: U.S. charges Russian man as boss of LockBit ransomware group (May 2024)
- News12 New Jersey: Freehold Township schools reopen following cybersecurity incident (Jan. 2024)
- City of Hamilton: Cybersecurity incident FAQ
- CP24: Hamilton taxpayers on the hook for full $18.3M cyberattack bill after insurance claim denied (July 2025)
- The Register: Washington courts outage (Nov. 2024)
- Pierce County: Clerk's office service modifications due to Washington Courts network outage (Nov. 2024)
- KGW: State systems back online after cybersecurity threat stalled multiple agencies (Nov. 2024)
- FBI Internet Crime Complaint Center (IC3)
Top image: "Montreal City Hall Jan 2006" by David Iliff, CC BY 2.5, via Wikimedia Commons (resized). Charts by Thank You Robot.
0 Comments