The City of Coweta is working to recover from a system-wide ransomware attack that has taken most city computer systems offline.
City officials say residents’ credit card and other payment data are not kept on City servers and were not accessed in this attack.
The city said it immediately contacted its contracted IT provider and additional cybersecurity professionals to secure systems, stop further intrusion and begin recovery efforts.
Officials say an offsite backup of city data exists and will be used to restore files once systems are cleared and safe to bring back online.
What’s affected
The ransomware attack has disrupted most city computer systems and services, including:
- All City computers and computer files.
- Computer-based city services.
- City computer systems, which are currently inoperable.
- Credit and debit card utility payments at City Hall.
- Staff access to electronic records while systems remain offline.
What’s not affected
City officials say several key services continue to operate normally, including:
- Emergency services, including 911.
- Coweta Police Department and Fire Department operations that rely on offsite systems, including LexisNexis.
- Residents’ credit card and payment information, which is not stored on city servers and was not accessed during the attack.
- The City of Coweta website.
- Xpress Bill Pay, the city’s third-party online billing portal.
Utility payments
Although in-person card payments at City Hall are unavailable, residents still have several options.
- Online payments through Xpress Bill Pay remain available and are safe to use.
- Residents may continue paying utility bills by check at City Hall.
- City staff are available to help customers who normally pay by card navigate the online payment portal.
- Water service will not be disconnected for nonpayment while city systems remain affected.
Investigation and recovery
The city is working with outside cybersecurity attorneys and IT experts to restore operations and determine whether any additional data was accessed.
Officials said the attack has been reported to local and state authorities, and reporting to the appropriate federal agencies is underway.
What’s next?
City officials say they recognize the inconvenience the outage has created for residents and are working to restore services as quickly and securely as possible.
Another public update is expected early next week.
