City of Norcross: Norcross Ransomware Attack Hit City Systems Weeks Before Officials Went Public

Norcross, Georgia Hit by Ransomware Attack as Municipal Cyber Threats Persist

The City of Norcross confirmed a ransomware attack on its computer networks on August 1, though officials only disclosed the incident publicly this week. While most systems have since been restored, city leaders have not provided a timeline for full recovery or revealed whether a ransom was demanded. Authorities have not identified the attackers, and it remains unclear if sensitive resident or employee data was compromised.

Norcross, a suburban city of 17,209 residents in Gwinnett County near metro Atlanta, engaged external cybersecurity experts to investigate the breach and notified law enforcement. The attack occurred just weeks after the city approved its $62.7 million FY2027 budget, which included $23.6 million for general operations including new cybersecurity investments effective September 1.

Under Georgia law, the city faces two key reporting obligations: one requiring disclosure of cyberattacks to the Georgia Emergency Management and Homeland Security Agency, and another mandating resident notifications if unencrypted personal data (such as Social Security or financial details) was exposed. Since Norcross has not confirmed whether such data was accessed, it is unclear if the second requirement will apply.

The incident follows a pattern of municipal cyberattacks in Georgia. Nearby Greene County took its networks offline for weeks in July after a similar intrusion, while a new Cyber Resiliency Center was launched to support local governments, schools, and hospitals. Metro Atlanta has seen high-profile attacks before, including the 2018 SamSam ransomware strike on Atlanta, which cost over $2.7 million in recovery. Gwinnett County has also faced past breaches, including a 2019 data encryption contract following police department intrusions.

Nationwide, local governments remain frequent targets, with recent disruptions reported in Fort Smith, Arkansas, and other municipalities. For now, Norcross residents are left with limited details an attack detected weeks ago, a partial recovery, and unanswered questions about the attackers and potential data exposure. City officials have stated they are prioritizing secure restoration and enhanced defenses.

Source: https://hoodline.com/2026/08/norcross-ransomware-attack-hit-city-systems-weeks-before-officials-went-public/

City of Norcross TPRM report: https://www.rankiteo.com/company/city-of-norcross

"id": "cit1788071024",
"linkid": "city-of-norcross",
"type": "Ransomware",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': 'Residents and employees',
                        'industry': 'Government',
                        'location': 'Norcross, Georgia, USA',
                        'name': 'City of Norcross',
                        'size': '17,209 residents',
                        'type': 'Municipality'}],
 'date_detected': '2024-08-01',
 'date_publicly_disclosed': '2024-08-00',
 'description': 'The City of Norcross confirmed a ransomware attack on its '
                'computer networks on August 1, though officials only '
                'disclosed the incident publicly this week. While most systems '
                'have since been restored, city leaders have not provided a '
                'timeline for full recovery or revealed whether a ransom was '
                'demanded. Authorities have not identified the attackers, and '
                'it remains unclear if sensitive resident or employee data was '
                'compromised.',
 'impact': {'operational_impact': 'Partial restoration of systems',
            'systems_affected': 'Computer networks'},
 'investigation_status': 'Ongoing',
 'post_incident_analysis': {'corrective_actions': 'Enhanced cybersecurity '
                                                  'defenses'},
 'references': [{'source': 'Cyber incident report'}],
 'regulatory_compliance': {'regulations_violated': ['Georgia law requiring '
                                                    'disclosure of '
                                                    'cyberattacks to the '
                                                    'Georgia Emergency '
                                                    'Management and Homeland '
                                                    'Security Agency',
                                                    'Georgia law mandating '
                                                    'resident notifications if '
                                                    'unencrypted personal data '
                                                    'was exposed'],
                           'regulatory_notifications': 'Georgia Emergency '
                                                       'Management and '
                                                       'Homeland Security '
                                                       'Agency'},
 'response': {'communication_strategy': 'Limited details provided to residents',
              'law_enforcement_notified': True,
              'remediation_measures': 'Systems restoration',
              'third_party_assistance': 'External cybersecurity experts'},
 'title': 'Norcross, Georgia Ransomware Attack',
 'type': 'Ransomware'}