Ransomware is a dangerous type of malware. When unleashed, files and programs are locked via encryption and the victim is threatened with permanent loss of access unless a ransom is paid. Unfortunately, even when the ransom is paid, the data is often unrecoverable. It’s not surprising that a criminal who extorted you would also lie about the ability to recover from the attack.

Ransomware can affect individuals, but it more frequently affects businesses and government entities. Devastating outcomes of ransomware include tasks and services suspended, files lost, and money extorted. This can lead to loss of revenues as well as loss of confidence when the public finds out about the breach. This week, we highlight two recent cases affecting major cities.

In March, Baltimore’s 911 dispatch system was hacked, forcing the temporary shutdown of some dispatch functions. Other functions, such as caller location identification, were forced into manual mode which could have affected the speed and accuracy of police dispatch. While details on a ransom were not available, the disruption lasted over 24 hours. And this isn’t the first time the city’s operations were hit with malware. In 2015, the city’s website was forced to shut down for more than 16 hours after a phishing email spread a cyber infection.

Also in March, the city of Atlanta experienced a widespread ransomware attack. The city’s network and services were crippled for more than a week. A $50,000 bitcoin ransom was demanded, although it’s unclear whether or not the city paid the fee. The ransom pales in comparison, however, to the $2.6 million the city spent in emergency contracts procured to mitigate the issues stemming from the attack. These contracts included services for “incident response, digital forensics, extra staffing, and Microsoft Cloud infrastructure expertise…”

While the expense was large, the City of Atlanta should be better equipped to handle a future attack. In this environment, it’s likely only of a matter of when the next attack will occur.