City leaders in Coweta are standing firm against hackers after a ransomware cyberattack froze municipal computer systems earlier this week, and they say paying up was never on the table.
The cyberattack, which struck city hall on Wednesday, encrypted local files, Word documents, Excel spreadsheets and financial systems across multiple departments. Hackers demanded payment, but officials cut off communication almost immediately, betting that a full system restore from offsite backups will resolve the crisis faster and more safely than negotiating with criminals.
For residents, the bigger question is what this cyberattack means for their personal information, their utility bills and city services in the days ahead. Here is what officials have confirmed, what remains under investigation and what residents need to know while recovery continues.
What Happened in the Coweta Cyberattack
City officials say the intrusion was identified Wednesday when internal systems began showing signs of encryption across shared drives and municipal databases.
The Ransomware Strain Behind the Attack
Investigators have identified the malware used in the cyberattack as Anubis, a ransomware variant that encrypts files and demands payment in exchange for a decryption key. Anubis has been used in attacks against local governments and businesses elsewhere, typically exploiting weak authentication controls or unpatched software to gain initial access to a network.
City Manager Julie Casteen confirmed the attackers made contact with a ransom demand but said the city has refused to engage.
“They’ve demanded a ransom,” Casteen said. “We don’t know what the amount is because we’re not communicating with them. We just refuse to do that.”
Why Coweta Is Refusing to Pay
Casteen said her decision is informed by firsthand experience from a previous role at another municipality that did pay a ransom, only to be targeted again.
“I’ve been through that process before with another city and we actually got reinfected two weeks after we paid the ransom,” Casteen said. “I think there’s a lot of different thoughts on that, but a lot of people feel if you pay the ransom, it makes the attackers realize, ‘Oh, they paid it once. Let’s hit them again.'”
Her position reflects broader guidance from federal cybersecurity agencies, which have long discouraged ransom payments on the grounds that they do not guarantee data recovery and can encourage repeat targeting.
Is Resident Data Safe After the Cyberattack
City leaders moved quickly to address concerns about financial and personal information following the cyberattack.
Payment Systems Were Not Affected
Officials confirmed that credit card numbers and payment information were not exposed. Utility and bill payment processing runs on a separate cloud-hosted platform that was never connected to the compromised network.
“There has been no infiltration onto our city payment system,” a city official said. “That is a separate system held in the cloud and we can assure you that no citizen payment information has been accessed.”
Emergency Services Remain Fully Operational
The cyberattack did not disrupt public safety operations. Both 911 dispatch and the police and fire departments operate on independent offsite networks that were not affected by the breach, meaning emergency response has continued without interruption.
How the Cyberattack Is Affecting Daily City Operations
| Service or System | Current Status |
|---|---|
| City hall computer network | Offline, restoring from backup |
| Payment and billing platform | Unaffected, fully operational |
| 911 dispatch, police, fire | Unaffected, fully operational |
| Water shutoffs for nonpayment | Temporarily suspended |
| Late payment penalties | Temporarily suspended |
| Online utility payments | Available via Xpress Bill Pay |
| In-person payments | Available at City Hall |
Utility Payments Still Available
Residents can continue paying utility bills online through Xpress Bill Pay via the city’s website or by dropping off a check at City Hall. Staff members are also available onsite to help residents complete payments in person while the network remains down.
Water Shutoffs and Late Fees Paused
As a goodwill measure during the outage, the city has suspended water shutoffs for nonpayment as well as late penalty fees, giving residents flexibility while billing systems are restored.
The Investigation and Road to Recovery
Contracted IT specialists, cyber insurance investigators, local police and the FBI are jointly examining server logs to determine how the attackers gained access and whether any data was exfiltrated before encryption occurred. Involving federal investigators is standard practice in ransomware cases affecting government infrastructure, both to trace the source of the intrusion and to support any potential criminal prosecution.
Systems Expected Back Online by Monday
The city is rebuilding its network from an offsite backup rather than negotiating with the attackers, with officials targeting full restoration of computer systems by Monday.
Coweta Upgrading Security to Prevent Future Cyberattacks
In response to the breach, Coweta is moving to strengthen its cybersecurity posture by upgrading from standard multi-factor authentication to passkey-based login credentials. Passkeys are considered more resistant to phishing and credential-theft techniques than traditional MFA codes, which experts say are increasingly targeted in ransomware campaigns similar to the one that hit Coweta.
Why This Cyberattack Matters Beyond Coweta
Ransomware attacks on local governments have become increasingly common in recent years as municipalities manage sensitive resident data with limited cybersecurity budgets. Coweta’s response, refusing payment, isolating unaffected systems and rebuilding from backups, mirrors the approach recommended by federal agencies for organizations facing similar cyberattacks. The outcome of the investigation and recovery effort may offer a case study for other small and mid-sized cities weighing how to respond when their own networks come under attack.
This is a developing story and will be updated as officials release new information about the cyberattack, the investigation and the city’s full system restoration.
