Ransomware Unveiled: Cybersecurity Expert Analyzes Cobb County Hack Impact

Ransomware Unveiled: Cybersecurity Expert Analyzes Cobb County Hack Impact

Cobb County, Georgia, spent much of 2025 dealing with the fallout of a ransomware attack on its government servers. Here is what happened, what the attackers claim to have taken, and what residents and other local governments can learn from it.

Summary

• Cobb County Cyber Attack: The Qilin ransomware group broke into county servers in March 2025.
• Expert Analysis: A security expert interviewed by FOX 5 Atlanta explained what the attackers took.
• Immediate Impacts: Qilin said it held 150 gigabytes of data and published samples.
• Security Narrative: The county refused to pay and offered credit monitoring.
• Future Implications: Residents were urged to freeze credit and turn on two-factor authentication.

Qilin hits Cobb County

The attack on Cobb County shows how exposed local governments are. According to FOX 5 Atlanta, the Qilin ransomware gang broke into county servers in March 2025 and later said it was holding 400,000 files for ransom. Criminal groups like Qilin steal data and encrypt systems, then demand payment to keep the data private.

Cobb County is far from alone. Ransomware gangs keep hitting cities and counties across the U.S., often because their budgets and security staff are thin.

What the attackers took

Rick Hudson, Chief Technology Officer for Critical Path Security, told FOX 5 Atlanta that Qilin had published 16 images to prove the hack, including autopsy photos, driver’s licenses and Social Security cards. An earlier version of this article attributed quotes to a “David Lacey” in a FOX 5 interview; those quotes could not be found in FOX 5’s coverage and have been removed.

“They have 150 gigabytes of data, that’s a lot of data, a lot of information,” Hudson said.

He said anyone who has dealt with the county government in the last several years could be affected.

The county’s response

The county said it would not pay. In a statement quoted by FOX 5, it said: “We refuse to support or enable criminal enterprises, even when faced with difficult choices.”

Cobb County offered credit monitoring and identity theft protection to people affected, and urged residents to watch their bank accounts. The refusal to pay has a cost. Residents’ data may end up public.

What residents should do

Hudson advised freezing credit, changing passwords and turning on two-factor authentication on every account. Those steps limit what criminals can do with leaked data.

“Qilin is definitely on the aggressive side, so they’re definitely going to release the documents. Establishing those extra precautions early will defend you better,” Hudson said.

Lessons for local governments

Cobb County’s experience is a warning for other local governments. Attackers go after the records cities and counties hold, from IDs to autopsy files, and refusing to pay doesn’t stop a leak.

Prevention is cheaper than recovery. Phishing training, multi-factor authentication, offline backups and a tested incident plan are the basics.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.