Recovery costs for Baltimore hack to exceed $18m
Cleanup effort and lost revenue is expected to cost more than 180 times the initial ransom


The devastating ransomware attack that crippled the city of Baltimore's public services for more than two weeks will cost approximately $18.2 million (14.3 million) to put right, according to the city's mayor.
Cleanup efforts in the immediate aftermath of the attack will cost Baltimore $10 million through to the end of the year, according to mayor Bernard Young, speaking at a council hearing last week. Meanwhile, an additional $8 million in costs have been sustained due to deferred or lost revenue while the city was unable to process payments.
The city's IT office has already spent $4.6 million on recovery operations since the attack on 7 May, city officials revealed, with an additional $5.4 million earmarked to be spent by the end of the year, according to the Baltimore Sun.
"We're not going to pay criminals for bad deeds. That's not going to happen," Young said in response to questions over the expected costs, adding: "There's no guarantee that if you pay, you reset your system".
For more than two weeks in May, thousands of government computers were infected with malware, said to be a strain known as RobinHood. This shut down a string of government services including those for paying taxes and parking tickets, as well as internal email systems.
In contrast with the eye-watering costs of the hack revealed this weak, the hackers asked for just 13 bitcoins, valued at just under $100,000 at the time.
Mayor Young has since faced criticism over his handling of the attack, with his repeated refusal to pay the ransom being branded as "shortsighted" by Forrester analyst Josh Zelonis.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
"While many advise against paying ransoms, Forrester has been tracking a trend of companies that negotiated with the extortionists and paid for decryption keys as part of their incident recovery," he said.
"Conventional wisdom does not factor in what is best for your business and the situation you are currently in. Platitudes and emotion are not going to help you formulate an optimal recovery path for your business."
Meanwhile, recovery is complicated, and even if there are good backups, businesses tend to underestimate the scale of disruption that needs to be planned ahead for, he added.
Additional reports have since indicated the perpetrators used a Windows exploit developed by the National Security Agency (NSA) to target the city. The EternalBlue tool also exploits a vulnerability with Windows XP and Vista systems, also called EternalBlue. This flaw allows hackers to execute commands remotely on targeted devices.
The exploit has also been at the centre of a number of infamous cyber attacks including the WannaCry attack of May 2017 and NotPetya in June the same year.
The former had a particularly devastating effect on the NHS, costing the health service more than 92 million to recover. The bulk of these costs, 72 million, were allocated towards restoring its services to full operation and recover data in the immediate months following the attack.

Keumars Afifi-Sabet is a writer and editor that specialises in public sector, cyber security, and cloud computing. He first joined ITPro as a staff writer in April 2018 and eventually became its Features Editor. Although a regular contributor to other tech sites in the past, these days you will find Keumars on LiveScience, where he runs its Technology section.
-
New chapter, same partners: Keeping the channel aligned with change
Industry Insights How to maintain strong channel partnerships amid evolving strategies and market change
-
Palo Alto Networks snaps up CyberArk in identity security push
News The acquisition marks the latest in a string for Palo Alto Networks
-
The Scattered Spider ransomware group is infiltrating Slack and Microsoft Teams to target vulnerable employees
News The group is using new ransomware variants and new social engineering techniques - including sneaking into corporate teleconferences
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crime
News A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
-
Everything we know about the Ingram Micro cyber attack so far
News A cyber attack on Ingram Micro severely disrupted operations and has been claimed by the SafePay ransomware group.
-
A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'
News The Hunters International ransomware group is rebranding and switching tactics
-
Swiss government data published following supply chain attack – here’s what we know about the culprits
News Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackers
News While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making