Georgia Cybersecurity Breach Report 2025-2026: $534.6M Lost

Georgia broke into the FBI's national cybercrime top 10 in 2025 with $534.6 million in reported losses, and in May 2026 a small north Georgia county broke the state's eight-year public-sector pattern of refusing to pay ransoms.

Published by BlueRadius Cyber | August 2026 | All figures sourced and footnoted

This report compiles publicly verifiable Georgia-specific data on cybersecurity incidents, cybercrime losses, and the state regulatory environment from 2023 through mid-2026. Every figure is drawn from verified sources: FBI Internet Crime Complaint Center (IC3) annual reports, HHS Office for Civil Rights breach filings, official statements, and established reporting. Where an attribution comes from a ransomware gang or outside analyst rather than the affected organization, it is labeled that way.

Executive Summary

Georgia crossed a threshold in 2025. The state filed 25,936 complaints with the FBI IC3, ranking #10 nationally, and reported $534,581,965 in losses, ranking #9. Both figures represent Georgia's first appearance in the IC3 top 10 on either measure in recent years: complaints rose 31% and losses rose 27% over 2024.[1][2] More striking, Georgia ranked #1 in the nation for cybercrime losses among victims under 20, with minor victims reporting $3,087,376 in 2025 losses, the highest of any state.[1]

The same eighteen months produced a structural break in how Georgia's public sector responds to ransomware. From Atlanta's SamSam attack in 2018 through Fulton County in 2024 and Cobb County and Coweta County Schools in 2025, Georgia governments built a consistent public record of refusing to pay.[6][12][13] That pattern ended on May 13, 2026, when Murray County paid attackers $200,000 from county reserves.[14][15]

All of this is happening in a state that hosts U.S. Army Cyber Command at Fort Eisenhower and spent roughly $100 million on the Georgia Cyber Center, while operating one of the weakest breach notification laws in the United States: no deadline, no attorney general notice, no penalties.[18][19][20]

Key Findings

25,936 Georgia IC3 complaints in 2025 (#10 nationally), up 31% from 19,797 in 2024, when the state ranked #11.[1][2]
$534,581,965 in reported 2025 losses (#9 nationally), up 27% from $420,454,472 in 2024.[1][2]
Georgia is #1 in the nation for cybercrime losses among minor victims: $3,087,376 reported by victims under 20 in 2025.[1]
Murray County paid a $200,000 ransom on May 13, 2026, breaking an eight-year public record of Georgia governments refusing to pay, from Atlanta 2018 through Fulton, Cobb, and Coweta.[14][15]
Fulton County refused both LockBit ransom deadlines after its January 2024 attack, then approved a $10.2 million IT overhaul with CGI.[3][4][5][6]
176,149 Harbin Clinic patients were affected by a July 2024 breach at vendor NRS; notifications began in May 2025.[16]
Wayne Memorial Hospital took more than a year to notify roughly 161,000 of its 163,440 affected patients of a breach that began May 30, 2024.[17]
Georgia's breach law, O.C.G.A. 10-1-912, sets no notification deadline, requires no attorney general notice, and carries no penalties, making it one of the weakest in the country.[20]
Federal cyber grant funding to Georgia more than doubled: $4.8 million to 55 agencies in October 2024, then $9,873,903 to 44 entities in March 2026 with K-12 schools as a priority.[21]

The Headline Numbers: Georgia in the FBI IC3 2025 Annual Report

The FBI Internet Crime Complaint Center publishes annual state-by-state data on reported internet crime. The 2025 report shows Georgia moving up the national rankings on both measures that matter.[1]

National Context

Rankings tell the national story as clearly as raw dollars. In the 2024 IC3 report, Georgia ranked #11 in complaints and #7 in losses.[2] In 2025, Georgia's complaint count grew 31% and its rank improved to #10, while its dollar losses grew 27% and its rank nonetheless slipped from #7 to #9.[1][2] Georgia lost over $114 million more than the year before and other large states still grew faster: cybercrime losses are compounding nationally, and a 27% increase was not enough to hold relative position.

One Georgia figure has no national parallel. In the 2025 report, Georgia ranked #1 among all states for losses reported by victims under 20, at $3,087,376.[1] The IC3 data does not explain why Georgia leads this category, but the figure lands directly on the state's school districts, which appear repeatedly in the incident record below.

Georgia Breakdown

The 2024 baseline: 19,797 complaints and $420,454,472 in losses.[2] Within that year, cryptocurrency-related fraud accounted for 3,533 Georgia complaints and $197.6 million in losses, nearly half the state's dollar total, and Georgians aged 60 and older reported $174.7 million in losses, ranking the state #7 nationally for elder losses.[2]

The 2025 result: 25,936 complaints and $534,581,965 in losses.[1] Year over year, that is 6,139 additional complaints and more than $114 million in additional reported losses, and IC3 figures cover only what victims actually report to the FBI.

Eight Years of Refusing to Pay, and the Payment That Broke the Pattern

Georgia's public sector spent eight years building one of the clearest no-payment records in the country, and that record is the narrative spine of this report.

It started in Atlanta. On March 22, 2018, the SamSam ransomware group hit the city and demanded roughly $51,000. Atlanta refused. A confidential city report obtained by the Atlanta Journal-Constitution projected recovery costs of approximately $17 million, and on November 26, 2018 the Department of Justice indicted two Iranian nationals for the attack.[6][11] Atlanta established the template: refuse, absorb the recovery cost, pursue attribution.

The template held. Augusta refused a $2 million BlackByte demand after its May 21, 2023 attack; the gang leaked roughly 10 GB of a claimed 70 GB, and a rumored "$50 million" demand circulating online was debunked.[11] Fulton County refused LockBit twice in early 2024.[3][4] Cobb County refused in March 2025, stating "We refuse to support or enable criminal enterprises."[12] Coweta County Schools refused in May 2025.[13]

Then Murray County paid. On May 13, 2026, the north Georgia county was hit by ransomware and paid $200,000 from county reserves, the rare well-documented ransom payment by a Georgia local government.[14][15] Two months later, Greene County answered its own intrusion by unplugging every county server.[13] Refuse and rebuild, pay and contain, or disconnect everything: Georgia's counties are now running all three playbooks in public, and every attacker surveying the state's 159 counties now knows the no-pay wall has a documented breach.

Major Georgia Government and School Incidents, 2023-2026

Fulton County: LockBit 3.0 (January 2024)

The anchor incident of this reporting period. Fulton County, home to most of Atlanta, discovered a LockBit 3.0 ransomware attack on January 27-28, 2024. County phone lines, court systems, and property tax processing went down.[3][4][5] LockBit set two ransom deadlines; Fulton County let both pass without paying. County Commission Chairman Robb Pitts was categorical: the county "did not pay nor did anyone pay on our behalf."[3]

The attack coincided with Operation Cronos, the international law enforcement takedown of LockBit infrastructure that unfolded in the same window.[3][4] Fulton County has not published a recovery cost figure. What it did publish is the structural response: a later $10.2 million infrastructure overhaul contract with CGI.[5]

Coffee County: Voter System Disconnection (April 2024)

Coffee County detected a cyber incident on April 15-16, 2024 and notified CISA. The Georgia Secretary of State's office responded by cutting the county's access to GARViS, the state's voter registration system, and to the ePulse platform as a precaution. Investigators found no evidence of data exfiltration.[7]

The incident carried unusual weight because of the county's history: on January 7, 2021, local officials allowed unauthorized imaging of voting equipment, conduct later charged in the Fulton County election interference case.[8] In 2024 the same county became a live test of Georgia's election-infrastructure isolation procedures, and the state chose disconnection first.

Macon-Bibb County (May 2024)

Over the weekend of May 11, 2024, Macon-Bibb County took its network offline in response to a cyber incident. Email and phone systems were down for days; the county never confirmed ransomware, and no verified data-theft claim emerged.[9] Even unconfirmed intrusions impose real operational cost.

Henry County Schools (November 2023)

Henry County Schools, serving roughly 43,000 students south of Atlanta, detected an attack on November 9, 2023. Teachers went back to paper gradebooks, bus GPS tracking was unavailable for more than a month, and restoration stretched into January 2024, with DHS, the FBI, and the Georgia Emergency Management and Homeland Security Agency (GEMA) involved.[10] Two months of degraded operations is the realistic cost model for K-12 ransomware.

Savannah-Chatham and the PowerSchool Vendor Breach (December 2024)

The PowerSchool student information system breach of December 28, 2024, disclosed to districts on January 8, 2025, reached Georgia through its school districts, including Savannah-Chatham County Public Schools.[22] Georgia districts did not need to be attacked directly; a single national education vendor put their student data in scope. Combined with Georgia's #1 ranking for cybercrime losses among minor victims, the K-12 exposure pattern in this state is now visible from two independent directions.

Cobb County (March 2025)

Cobb County, one of Georgia's largest, detected a ransomware attack on March 21, 2025 and restored systems by March 27. The county confirmed it was a ransom attack and refused to pay: "We refuse to support or enable criminal enterprises." At least 10 individuals were confirmed affected.[12]

Attribution requires careful labeling here. An outside expert cited in 11Alive's reporting attributed the attack to the Qilin ransomware gang, with a claimed $1 million demand and 150 GB of allegedly stolen data; Cobb County has not confirmed the gang, the demand, or the volume, and this report treats all three as reported but unconfirmed.[12]

Coweta County Schools (May 2025)

In early May 2025, a cyberattack on the Coweta County School System, which serves about 23,000 students, forced the cancellation of SAT testing at three high schools. The district refused to pay, and GEMA and DHS assisted in the response.[13] A gang called Nitrogen claimed the attack; the claim is unofficial, the district denied it, and this report treats the attribution as unverified.[13]

Murray County: The $200,000 Payment (May 2026)

The May 13, 2026 attack disrupted tax offices and probate and juvenile courts; 911 dispatch was unaffected and voting operations continued. Sole Commissioner Noah Bishop authorized a $200,000 payment from county reserves on the advice of the county's cybersecurity consultants, "to prevent the publication of County data."[14][15] For a small county, $200,000 is a material budget event, and the decision will be cited on both sides of Georgia's pay-or-refuse debate for years.

Greene County: Total Disconnection (July 2026)

The freshest incident in this report. Greene County detected an intrusion on July 9, 2026, and its IT contractor responded by disconnecting all county servers. Tax services, court operations, and payment processing were disrupted; 911 was unaffected, and as of mid-July investigators had found no evidence of data theft.[13] Full disconnection traded days of county-wide outage for containment certainty.

Georgia Healthcare Breaches

Harbin Clinic via NRS: 176,149 Patients (2024-2025)

Harbin Clinic in Rome was hit through its third-party vendor NRS, which suffered a breach between July 5 and July 11, 2024. Harbin reported 176,149 affected patients to HHS OCR; a Maine attorney general filing put the related count at 210,140. Notifications did not begin until May 2025, roughly ten months later, and the NRS incident affected approximately 500,000 people across all of the vendor's clients.[16]

Wayne Memorial Hospital: A One-Year Notification Gap

Wayne Memorial Hospital in Jesup suffered a breach beginning May 30, 2024, claimed by the Monti ransomware group, affecting 163,440 people. Roughly 161,000 of those individuals were not notified until August 27, 2025, more than a year after the intrusion began.[17] Under HIPAA's federal 60-day notification requirement, a gap of that length is the kind of fact pattern that draws OCR scrutiny. Under Georgia's state breach law, as discussed below, it triggers nothing at all.

Good Samaritan Health Center (February 2026)

The Good Samaritan Health Center, an Atlanta nonprofit clinic, suffered a ransomware attack on February 9, 2026 and notified approximately 10,000 patients in March 2026. The Qilin gang claimed responsibility; as with Cobb County, the gang's claim is not an official attribution.[16] The incident shows the current targeting floor: a charitable clinic serving uninsured patients is inside the ransomware economy's addressable market.

The Georgia Paradox: A National Cyber Powerhouse With Exposed Counties

Georgia's county breach record is more striking because of where it happens. Fort Eisenhower in Augusta, renamed from Fort Gordon in October 2023, hosts U.S. Army Cyber Command (ARCYBER) and the Army Cyber Center of Excellence, which trains roughly 22,000 soldiers and personnel per year.[18] A short drive away sits the Georgia Cyber Center, a roughly $100 million state investment spanning 332,000 square feet, the largest state-owned cybersecurity facility in the United States.[19]

The state that trains a meaningful share of the nation's military cyber workforce watched Fulton, Cobb, Coweta, Murray, and Greene counties fall in a 30-month span. The gap is not talent or infrastructure; it is distribution. National cyber capability concentrated in Augusta does not patch servers in Murray County, and Georgia's 159 counties, most of them small, defend themselves with local budgets and, increasingly, federal grant money.

The Georgia Regulatory Environment

Georgia's breach notification statute, O.C.G.A. 10-1-912, requires notification of affected residents "in the most expedient time possible" and requires notification of consumer reporting agencies when a breach affects more than 10,000 Georgia residents. That is essentially the whole law. It sets no specific day-count deadline, requires no notice to the state attorney general, imposes no penalties for late or absent notification, and provides no private right of action.[20]

The practical consequences are visible in this report's own data. Wayne Memorial's one-year notification gap and Harbin Clinic's ten-month gap violated no Georgia statute, because there is no Georgia deadline to violate. Georgia breaches become public mainly through HHS OCR filings, other states' attorney general portals, and press reporting. For a state now in the IC3 top 10, that is one of the weakest accountability frameworks in the country.[20]

The Resourcing Response: SLCGP Grants

The state's most concrete response to the local government problem is money. Through the federal State and Local Cybersecurity Grant Program (SLCGP), administered in Georgia by GEMA and the Georgia Technology Authority, the state awarded $4.8 million to 55 local agencies on October 25, 2024, then $9,873,903 to 44 entities on March 25, 2026, with K-12 school districts named as a priority in the 2026 round.[21] The 2026 award more than doubles the 2024 round and directs funding at exactly the sector, schools, where Georgia's incident record and its #1 minor-victim loss ranking intersect.

What This Means for Georgia Mid-Market Organizations

Three operational implications follow directly from the data:

1. Recovery capability, not prevention promises, decided every outcome in this report

Fulton County refused to pay and rebuilt. Murray County could not tolerate publication of its data and paid $200,000. Greene County unplugged everything. The difference between those outcomes was whether each organization could restore operations and tolerate data exposure without the attacker's cooperation. Tested backups, segmentation, and a rehearsed pay-or-refuse decision framework determined results, and building that capability is core security-program leadership work, the kind an experienced virtual CISO installs before the incident rather than during it.

2. Your vendors are your breach surface, and Georgia law will not tell you when it happens

Harbin Clinic's 176,149-patient breach originated at vendor NRS. Savannah-Chatham's student data exposure originated at PowerSchool. With Georgia's statute imposing no deadline and no penalties, organizations cannot rely on the legal environment to surface vendor incidents promptly: Wayne Memorial's patients waited more than a year. Contractual notification clauses, vendor risk monitoring, and breach response obligations written into agreements have to do the work the statute does not. A fractional CISO engagement is the practical way most mid-market Georgia organizations get an executive owner for vendor risk without a full-time hire.

3. The threat has moved down-market, and the grant money proves the state knows it

Murray County, Greene County, Coweta County Schools, and a nonprofit charity clinic are not marquee targets; they are the current target profile. Georgia's SLCGP awards, $4.8 million in 2024 growing to $9.87 million in 2026 with K-12 priority, officially acknowledge that small public entities are the front line.[21] Private-sector organizations of similar size should read the same signal: if a county with a sole commissioner is worth a $200,000 ransom, a mid-market business with payroll data and cyber insurance is worth more.

For organizations in the metro Atlanta region, where Fulton, Cobb, Henry, and Coweta county incidents all landed, BlueRadius provides local coverage through its cybersecurity services in Atlanta practice, with programs built around exactly the incident patterns documented in this report.

Frequently Asked Questions

How much did Georgia lose to cybercrime in 2025?

$534,581,965 in reported losses, ranking #9 among U.S. states, from 25,936 complaints, ranking #10, according to the FBI IC3 2025 Annual Report. Losses rose 27% and complaints rose 31% over 2024, when Georgia reported $420,454,472 in losses from 19,797 complaints.[1][2]

Is Georgia really #1 for cybercrime losses among minors?

Yes. In the FBI IC3 2025 Annual Report, Georgia victims under 20 reported $3,087,376 in losses, the highest total of any state.[1] The IC3 data does not break out the causes, but the ranking coincides with a run of Georgia K-12 incidents including Henry County Schools, Coweta County Schools, and the PowerSchool vendor breach affecting districts such as Savannah-Chatham.

Has any Georgia government paid a ransomware demand?

Murray County paid $200,000 from county reserves on May 13, 2026, on consultant advice, "to prevent the publication of County data" per Sole Commissioner Noah Bishop.[14][15] It is the rare well-documented payment by a Georgia local government, breaking a refusal pattern running from Atlanta in 2018 through Fulton, Cobb, and Coweta.

What happened in the Fulton County cyberattack?

Fulton County discovered a LockBit 3.0 ransomware attack on January 27-28, 2024, taking down phones, court systems, and property tax processing. The county refused both ransom deadlines and later approved a $10.2 million IT overhaul contract with CGI; no recovery cost figure has been published.[3][4][5]

What were the largest Georgia healthcare breaches in this period?

Harbin Clinic in Rome reported 176,149 affected patients to HHS OCR after a July 2024 breach at its vendor NRS, with notifications beginning in May 2025.[16] Wayne Memorial Hospital in Jesup reported 163,440 affected people from a breach beginning May 30, 2024, and roughly 161,000 of them were not notified until August 27, 2025.[17] The Good Samaritan Health Center in Atlanta notified about 10,000 patients after a February 9, 2026 ransomware attack claimed by Qilin.[16]

What does Georgia's data breach law require?

O.C.G.A. 10-1-912 requires notification of affected Georgia residents "in the most expedient time possible" and notification of consumer reporting agencies when more than 10,000 residents are affected. It sets no specific deadline, requires no notice to the attorney general, imposes no penalties, and provides no private right of action, which places it among the weakest breach notification laws in the country.[20]

What cybersecurity funding is available to Georgia local governments and schools?

The State and Local Cybersecurity Grant Program, administered by GEMA and the Georgia Technology Authority, awarded $4.8 million to 55 Georgia agencies on October 25, 2024 and $9,873,903 to 44 entities on March 25, 2026, with K-12 school districts as a stated priority in the 2026 round.[21] Organizations wanting to benchmark their current posture before pursuing grant-funded projects can start with a structured review: request a free cybersecurity assessment.

Cite This Report

Journalists, researchers, and security teams are welcome to cite this report with attribution:

Source: "Georgia Cybersecurity Breach Report 2025-2026," BlueRadius Cyber, a virtual CISO services firm. https://blueradius.io/georgia-cybersecurity-breach-report-2026

Media inquiries and questions about the underlying data can be directed to us through the contact page.

Engage a vCISO to Operationalize These Findings

The incidents documented here were decided by whether each organization had tested recovery, an executive owner for vendor risk, and a rehearsed answer to the pay-or-refuse question before the attacker forced it. That is security program leadership, and it does not require a full-time hire. BlueRadius's virtual CISO services put a senior security leader inside your organization to turn findings like these into a board-defensible program.

The fastest way to see where you stand against the patterns in this report, ransomware recovery readiness, vendor breach exposure, and notification obligations, is a free cybersecurity assessment scoped to your environment.

BlueRadius Research Library

Sourced research reports across the BlueRadius catalog:

Sources

[1] FBI Internet Crime Complaint Center, "2025 Internet Crime Report," state statistics for Georgia. ic3.gov.

[2] FBI Internet Crime Complaint Center, "2024 Internet Crime Report," state statistics for Georgia. ic3.gov.

[3] The Record, reporting on the Fulton County LockBit 3.0 attack and the county's refusal to pay. therecord.media.

[4] StateScoop, coverage of the Fulton County ransomware attack and Operation Cronos timing. statescoop.com.

[5] Government Technology, coverage of Fulton County's recovery and the $10.2 million CGI infrastructure overhaul. govtech.com.

[6] CBS News, reporting on the Fulton County attack and Atlanta's 2018 SamSam precedent. cbsnews.com.

[7] CyberScoop, reporting on the April 2024 Coffee County incident and the state's disconnection of GARViS and ePulse access. cyberscoop.com.

[8] Georgia Recorder and Associated Press, reporting on the January 7, 2021 Coffee County voting-equipment imaging and related charges. georgiarecorder.com.

[9] StateScoop and The Macon Melody, coverage of the May 2024 Macon-Bibb network shutdown. maconmelody.com.

[10] Government Technology and Henry County Schools official communications on the November 2023 attack. henry.k12.ga.us.

[11] The Record, The Register, and BleepingComputer, reporting on the May 2023 Augusta BlackByte attack; Atlanta Journal-Constitution reporting on the 2018 SamSam attack's $17 million cost projection and the DOJ indictment. ajc.com.

[12] Government Technology, coverage of the March 2025 Cobb County attack and refusal statement; 11Alive, reporting an outside expert's unconfirmed Qilin, $1 million, and 150 GB claims. 11alive.com.

[13] Fox 5 Atlanta, reporting on the May 2025 Coweta County Schools attack and Nitrogen denial, and on the July 2026 Greene County incident. fox5atlanta.com.

[14] Local 3 News and Chattanooga Times Free Press, reporting on the May 13, 2026 Murray County attack and $200,000 payment. timesfreepress.com.

[15] HSToday, coverage of the Murray County ransom payment. hstoday.us.

[16] HIPAA Journal and SecurityWeek, reporting on the Harbin Clinic breach via vendor NRS and the Good Samaritan Health Center attack; Good Samaritan Health Center notice. hipaajournal.com.

[17] Security Magazine, reporting on the Wayne Memorial Hospital breach and August 27, 2025 notifications. securitymagazine.com.

[18] U.S. Army Cyber Center of Excellence, Fort Eisenhower mission and training figures. ccoe.army.mil.

[19] Georgia Technology Authority, "Georgia Cyber Center," facility investment and scale. gta.georgia.gov.

[20] O.C.G.A. 10-1-912, Georgia breach notification statute, via Justia. law.justia.com.

[21] Georgia Emergency Management and Homeland Security Agency, SLCGP award announcements of October 25, 2024 and March 25, 2026. gema.georgia.gov.

[22] WSAV, WTOC, and 11Alive, reporting on the PowerSchool breach (December 28, 2024; districts notified January 8, 2025) and its effect on Savannah-Chatham and other Georgia districts. wsav.com.

All figures and named incidents in this report are drawn from publicly available primary sources or established secondary reporting. Ransomware gang claims and outside-expert attributions are labeled as claims wherever the affected organization has not confirmed them.

Georgia Cybersecurity Breach Report 2025-2026: $534.6M in Losses, 25,936 Complaints