The attack on Hall County — home to Gainesville and located roughly an hour north of Atlanta — was disclosed on Oct. 7, but the impact to election infrastructure is only now coming to light.
“We are currently bringing various programs back online, and those two items are included in that process,” Crumley said. “However, the voting process for our citizens has not been impacted due to the network issues.”
The attackers in this case do not appear to have specifically targeted election systems; other county functions, including phone and email services, were also disrupted. Ransomware attackers are typically financial criminals driven by profit, experts say, not political actors with a political motive.
But the incident marks the first known case of a ransomware attack affecting election infrastructure in the 2020 election, three cybersecurity experts told CNN.
“This is the first incident that I’m aware of which has directly impacted election-related infrastructure,” said Brett Callow, a threat analyst at the security firm Emsisoft. “At least 18 county or municipal bodies have been impacted by ransomware since the beginning of September — about three per week — so it’s very likely that other bodies will be hit in the run-up to the election.”
Ekram Ahmed, a spokesperson for the cybersecurity firm Check Point, called the Georgia incident “alarming and significant.”
“Often, hackers like to run experiments on smaller places and institutions, treating them as testing-grounds for larger-scale attacks down the road,” Ahmed said. “We urge voters to be extra cautious in the days leading up to election night, especially when it comes to their inbox.”
Fraudulent emails can often contain malicious links or attachments that allow hackers to penetrate unpatched or vulnerable systems. So-called phishing attacks are the most likely way for ransomware incidents to begin, experts say.
Morgan Wright, chief security advisor at SentinelOne, said the Hall County attack is unlikely to be related to the Iranian threat outlined by US intelligence.
“I don’t think they’re tied together,” he said. “I think these guys are just opportunistic.”