FULTON COUNTY, Ga. — Sensitive information and some Fulton County services hang in the balance after a data breach that's had a grip on the county for several weeks.
Friday was the deadline cyber criminals set; either they would be paid or they could release the information. The group proved it had obtained highly sensitive information.
Cybersecurity experts who have seen some of the data said it goes beyond financial information or social security numbers. They said it includes sensitive health information for residents in the county who have cancer or who are living with HIV.
"This is one of the best ransom groups in the world," cybersecurity expert Patrick Kelley with Léargas Security said.
For weeks, the cybercrime group LockBit 3.0 has claimed to have been holding sensitive information from Fulton County hostage for $1.2 billion, according to its own public post provided to 11Alive by cybersecurity experts.
"They are consistent, they don't bluff, and if they say they have the data, they prove it," Kelley said.
Kelley added the group is one of the most sophisticated around.
"We have backup of Apple phones that are owned by government officials, so there's going to be sensitive information on that," Kelley said.
There are also sealed court filings involving juveniles and evidence in current criminal cases.
"You could unearth the names of confidential informants or undercover police force," Kelley said.
Kelley said the Fulton County breach goes even further because the group captured sensitive health information like medical treatments and specific illnesses of residents in the county.
"If your credit card is stolen, you'll get another one. Even social security numbers can be reissued. Someone knowing that you have cancer or knowing that you're HIV positive, these things impact every aspect of your life," Kelley said.
The ransom post stated the county had until Friday morning to pay up, or the information would be released.
Kelley and another cybersecurity expert said Fulton County is no longer listed in LockBit 3.0's portal.
"If you agree on time or making movement, they'll remove you from the portal. But I have never seen LockBit3.0 remove anyone from the portal unless they have paid," Kelley said.
Since the attack was announced, Fulton County has held multiple media briefings but took no questions.
11Alive reached out to county officials to find out if a ransom attack was paid or if security issues have been fixed.