The US Attorney 's Office for the District of Northern Georgia announced Wednesday that a federal grand jury had returned indictments against two Iranian nationals charged with executing the March 2018 ransomware attack Attack.Ransom that paralyzed Atlanta city government services for over a week . Faramarz Shahi Savandi and Mohammed Mehdi Shah Mansouri are accused of using the Samsam ransomware to encrypt files on 3,789 City of Atlanta computers , including servers and workstations , in an attempt to extort Attack.Ransom Bitcoin from Atlanta officials . Details leaked by City of Atlanta employees during the ransomware attack Attack.Ransom , including screenshots of the demand message posted on city computers , indicated that Samsam-based malware was used . A Samsam variant was used in a number of ransomware attacks Attack.Ransom on hospitals in 2016 , with attackers using vulnerable Java Web services to gain entry in several cases . In more recent attacks , including one on the health industry companies Hancock Health and Allscripts , other methods were used to gain access , including Remote Desktop Protocol hacks that gave the attackers direct access to Windows systems on the victims ' networks . The Atlanta attack was not a targeted state-sponsored attack . The attackers likely chose Atlanta based on a vulnerability scan . According to the indictment , the attackers offered Attack.Ransom the city the option of paying Attack.Ransom six Bitcoin ( currently the equivalent of $ 22,500 ) to get keys to unlock all the affected systems or 0.8 Bitcoin ( about $ 3,000 ) for individual systems . `` The ransom note directed the City of Atlanta to a particular Bitcoin address to pay the ransom Attack.Ransom and supplied a web domain that was only accessible using a Tor browser , '' a Department of Justice spokesperson said in a statement . `` The note suggested that the City of Atlanta could download the decryption key from that website . '' But within days of the attack , the Tor page became unreachable , and the City of Atlanta did not pay the ransom Attack.Ransom . Savandi , 27 , of Shiraz , Iran , and Mansouri , 34 , of Qom , Iran , have been charged under the Computer Fraud and Abuse Act ( CFAA ) for `` intentional damage to protected computers ... that caused losses exceeding $ 5,000 , affected more than 10 protected computers , and that threatened the public health and safety , '' the Justice Department spokesperson said . They are also charged in a separate indictment in the US District Court for the District of New Jersey in connection with another ransomware attack Attack.Ransom , in which a ransom was apparently paid Attack.Ransom .