Malware attack continues to cripple City of Savannah employees


SAVANNAH, Ga. (WSAV) – On Monday employees at the Recorder’s Court of Chatham County were greeted with an unusual and ominous sign:


The sign taped to computer screens is the latest part of a weeks long saga involved the City of Savannah and a malware attack, software intentionally used as a virus. Spokespersons for the city believe there was a phishing email that was possible opened by a city employee which spread the virus to other city computers.

Leaders with the City of Savannah say they were informed of the attack on February 9th. Two and a half weeks later, investigators and the city’s I.T. department have teamed up with the FBI to find the source and those responsible for the attack. Crews are working around the clock to refresh and restore every city computer. Each device had to be wiped and re-imaged in order to install updated software.

The city told News 3 there is not a threat to public safety.

“It’s not insurmountable but it is an inconvenience,” Alderman Julian Miller said. “Been a much bigger inconvenience for members of city staff who have been working tirelessly for weeks now to try to get past this”

He along with all members of City Council had to surrender their work laptops for observation and restoration. City employees across the board have also had trouble for several days receiving email, especially those with PDF attachments.

“Those of us on city council who are constantly in contact with our constituents and trying to represent them to staff on city,” Miller said. “I find it difficult because we don’t know when emails are coming through or when they’re not coming through.”

The city says every city issued computer must be wiped clean before the network can be restored.

“I don’t want constituents thinking that I’m not responding because I haven’t gotten their email, ” Miller explained.

A spokesperson for the city says there is not a ransom involved and there isn’t sufficient intelligence to know if other cities have been affected by this attack as well. The cause for the attack is still under investigation.

While all ‘essential’ city service are still in place, including parking, payroll, Water and Sewer, and the 911 Call Center, departments like Recorder’s Court have been crippled. From February 26- March 2, traffic court has been postponed, affecting potentially more than 1,000 cases that now must be rescheduled.

Miller told News 3 he can’t access the agenda for Thursday’s city council meeting but says at age 67, he can handle not having a computer for a short period of time.

“The city is still in charge of the city. This is a communication device but it is not the only communication device we have. We can still talk to each other and we can still pick up the phone and call each other,” he said.

He and other council members are now having to rely on social media, phone communications, and face-to-face interactions with constituents until the virus is resolved.

Copyright 2021 Nexstar Inc. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.

Trending Stories