Loading story…
Baltimore city government was hit by a RobbinHood ransomware attack that forced officials to shut down most servers, disrupted operations across roughly 10,000 government computers, and knocked multiple public services offline. City employees lost access to email, phones, billing systems, and administrative tools, while residents were unable to make online payments for water bills, property taxes, and parking tickets. Emergency services including 911 and 311 remained operational, but departments such as Public Works, Police, and Transportation were pushed to manual workarounds as federal investigators examined the intrusion.
The attackers reportedly demanded 3 Bitcoin per department or 13 Bitcoin for the entire city, with the price set to rise after several days and files allegedly becoming unrecoverable after 10 days. Baltimore refused to pay, and the outage stretched for at least two weeks, making it the city’s second major cyber disruption in little more than a year after an earlier attack affected the 911 system. The incident became a prominent example of how ransomware can paralyze municipal government services and delay routine civic operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Baltimore IT Director Frank Johnson went on leave following criticism from City Council members over his leadership during the city's recovery from the May 2019 ransomware attack. The mayor's office said Deputy IT Director Todd Carter would serve as acting director.
After reports said the Baltimore ransomware attack spread using EternalBlue, Maryland political leaders and U.S. lawmakers sought briefings from the NSA and called for federal assistance. The development intensified scrutiny over whether Baltimore had missed available Microsoft patches and renewed debate over the fallout from leaked NSA-linked exploits.
City leadership decided not to pay the attackers' bitcoin demand despite prolonged service disruptions. The refusal left residents unable to use services such as online payments for water bills, property taxes, and parking tickets for at least two weeks.
Reporting on the Baltimore incident cited research indicating RobbinHood did not self-propagate and was likely deployed manually, such as through PsExec or after compromise of a domain controller. The analysis suggested attackers had already obtained administrative access and staged a public RSA key on targets before encryption began.
Authorities launched a federal investigation into the attack as the city continued responding to the outage. The investigation was underway while Baltimore worked to restore affected systems and services.
The ransomware operators demanded 3 bitcoin per department or 13 bitcoin for the entire city, with the price reportedly set to increase after four days and files becoming irretrievable after 10 days. The total demand was reported at roughly $100,000 at the time.
City officials said most government servers were taken offline as a precaution while emergency services such as 911 and 311 remained operational. The outage disrupted email, phones, billing, hearings, and online payments, forcing staff to use manual workarounds.
On 2019-05-07, attackers deployed RobbinHood ransomware against Baltimore's municipal network, compromising about 10,000 government computers. The attack disrupted core city operations and affected multiple departments, including Public Works, Police, and Transportation.
About 15 months before the May 2019 incident, Baltimore experienced another cyberattack that shut down the city's 911 system for roughly a day. This established that the 2019 event was the city's second major ransomware-related disruption in just over a year.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
baltimoresun.com
Open sourcearstechnica.com
Open sourcebaltimoresun.com
Open sourcenytimes.com
Open sourcenytimes.com
Open sourcevox.com
Open sourcearstechnica.com
Open sourcegizmodo.com
Open sourcearstechnica.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The City of Dallas said the **Royal** ransomware gang gained access to municipal systems on April 7, 2023, spent weeks conducting surveillance, and exfiltrated about **1.17 TB** of data before launching ransomware at 2 a.m. on May 3. The attack damaged hundreds of servers and more than a thousand endpoint devices, disrupting critical city operations including public safety dispatch, with police and ambulances reportedly sent to incorrect locations. Dallas activated its incident response plan, brought in outside cybersecurity firms, and coordinated with the **FBI** and **CISA**; more than 90% of affected services were restored within 18 days, and the city later approved **$8.5 million** for recovery and breach-notification work. Reporting on the incident said the intrusion exposed longstanding technical debt inside city systems, including outdated and unsupported software that increased risk despite recent gains in cybersecurity staffing and spending. The disruption echoed earlier ransomware damage in Atlanta, where city networks were hobbled by an attack linked to **SamSam**, forcing widespread shutdowns and recovery efforts with federal and private-sector assistance. Together, the incidents show how major U.S. municipalities remain high-value ransomware targets when internet-facing systems, patching gaps, and legacy infrastructure leave essential public services vulnerable.
Jun 29, 2026
The Maryland Transit Administration (MTA) experienced a significant cyberattack that resulted in the theft of sensitive data and disruption of certain services. The incident came to light when Maryland officials reported that several state departments, including the MTA, were affected by a cyberattack that impacted systems used to coordinate transportation for disabled individuals. The MTA confirmed that data was stolen during the attack, but did not disclose the number of affected individuals or the specific types of data compromised, citing the sensitivity of the ongoing investigation. The Rhysida ransomware gang, known for targeting government entities, claimed responsibility for the attack and demanded a ransom of 30 bitcoin, equivalent to approximately $3.3 to $3.4 million, giving the MTA seven days to comply. Rhysida published samples of the stolen data, which reportedly included passports, driver’s licenses, contracts, and other documents. The attack did not affect the MTA’s core transportation services such as bus lines, subways, and light rail, but it did disrupt real-time information systems and tools used for the Mobility service, which provides specialized transportation for people with disabilities. The Mobility service was restored through an interim call system on August 29, but the MTA has not specified the duration of the disruption. The Maryland Department of Information Technology is collaborating with cybersecurity experts and law enforcement agencies to investigate the breach and mitigate its impact. Analysis of Rhysida’s dark web post indicated the presence of internal financial and budget documents, though it is unclear if private personal details were included. Rhysida’s operation has compromised over 220 organizations globally, including high-profile victims such as the Seattle-Tacoma International Airport and the Anne & Robert H. Lurie Children's Hospital. The MTA has not confirmed whether the breach claimed by Rhysida is the same as the one it reported, but the timing and details strongly suggest a connection. The incident highlights the ongoing threat posed by ransomware groups to critical infrastructure and government services. The MTA has not indicated whether it intends to pay the ransom or negotiate with the attackers. The breach underscores the importance of robust cybersecurity measures and incident response planning for public sector organizations. The investigation is ongoing, and further details about the scope of the data loss and the attackers’ methods may emerge as authorities continue their work.
Jun 29, 2026
The City of Coweta, Oklahoma said a ransomware attack caused a system-wide outage across city computers, files, and computer-based services, disrupting municipal operations while leaving the city website and a third-party online billing portal accessible. Officials said the intrusion affected city systems broadly, prompting an immediate response with the city's contracted IT provider and additional cybersecurity professionals to secure the environment, contain further intrusion, and begin recovery efforts. City officials said the Coweta Police Department and Fire Department were not affected because they operate through off-site systems, and emergency services including **911** remained operational throughout the incident. The city also said it has an **offsite backup** and plans to use it to restore data once systems are cleared and deemed safe for recovery.
Aug 10, 2026