Loading story…
The Georgia Superior Court Clerks' Cooperative Authority (GSCCCA), which manages real estate, civil court filings, and other critical records for all 159 counties in Georgia, suffered a significant cyberattack attributed to the ransomware group Devman. The incident forced the GSCCCA to shut down its website and services, initially citing maintenance before confirming a credible and ongoing cybersecurity threat. The organization has since restricted access to its systems and is conducting extensive testing to ensure safety before restoring operations, warning of continued outages across the state.
Devman claimed responsibility for the attack, listing GSCCCA on its leak site and alleging the theft of 500 GB of sensitive data. The group is demanding a $400,000 ransom, with a deadline set for November 27. The GSCCCA holds extensive data, including real estate deeds, property filings, mortgage records, and legal archives, raising concerns about the potential impact of the breach. The attack follows a recent trend of ransomware targeting government and critical infrastructure organizations, with Devman previously linked to other high-profile incidents.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
GSCCCA publicly reported a credible and ongoing cybersecurity threat and said staff were working around the clock to test and analyze systems before restoring access. The agency warned that service disruptions could continue while validation efforts were underway.
After the disruption began, Devman added GSCCCA to its leak site, claiming it stole 500 GB of data and demanding $400,000. The group set a payment deadline of November 27, 2025.
On Friday, the Georgia Superior Court Clerks' Cooperative Authority said a cyberattack began and it immediately restricted access to its website and services, causing statewide outages. The organization initially framed the disruption as maintenance before confirming an active cybersecurity threat.
The Devman ransomware group emerged as a new operation in April 2025. Later reporting identified it as the group claiming responsibility for the GSCCCA incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Georgia county school district was listed as a victim by the **BlackSuit** ransomware gang, adding to evidence that the group is actively targeting public-sector organizations. The incident was reported after the gang posted the district on its leak site, a tactic commonly used to pressure victims by threatening publication of stolen data. The claim followed a joint **CISA** and **FBI** warning that the **Royal** ransomware operation may have rebranded as **BlackSuit**. U.S. authorities said the group uses familiar double-extortion tactics, combining file encryption with data theft, and warned organizations to harden defenses against phishing, remote access abuse, and other intrusion methods associated with the Royal/BlackSuit operators.
Aug 14, 2026
The **Qilin** ransomware operation claimed responsibility for compromising the **Augusta Housing Authority (AHA)** in Georgia and published sample files allegedly stolen from the agency, including internal correspondence, financial/expense documents, and spreadsheets containing sensitive personal information (e.g., utility reimbursement recipient data and employee benefits deductions). AHA had not publicly confirmed the intrusion, but reported ongoing efforts to restore website functionality amid access issues; reporting also notes Qilin’s high operational tempo in early 2026, with numerous claimed victims across sectors. Separately, a Georgia-based healthcare provider group, **ApolloMD**, reported to U.S. regulators that a 2025 intrusion exposed data for **626,540** individuals, including **SSNs** and medical/insurance information; ApolloMD said attackers accessed its IT environment over a short window in May 2025, and Qilin publicly claimed the attack in June 2025. A third report about **Conduent’s** 2025 ransomware incident (impact estimates rising to ~25 million) describes a different victim and event and is not part of the Qilin/Georgia victim reporting described above.
Jun 29, 2026
Memorial Hospital and Manor, a small community hospital in Georgia, has agreed to settle a class action lawsuit following a 2024 ransomware attack allegedly perpetrated by the Embargo cybercrime gang. The attackers claimed to have stolen 1.15 terabytes of sensitive data, which was subsequently leaked on the dark web. The breach affected approximately 105,170 current and former patients, and the hospital is offering settlement options, including payments of up to $5,000 for documented losses such as identity theft, fraud, and related expenses. The hospital, which includes both an 80-bed facility and a 107-bed long-term care center, is owned by the Hospital Authority of the City of Bainbridge and Decatur County. The settlement provides compensation for out-of-pocket expenses incurred as a result of the breach, including costs for credit monitoring, credit report fees, and replacement of identification documents. This resolution follows significant concern over the impact of the data leak on the affected community and highlights the ongoing risks posed by ransomware attacks on healthcare institutions.
Jun 29, 2026