Dive Brief:

• Lake City, FL has agreed to pay 42 Bitcoin (about $462,000) in ransom following a hack that has crippled the city for more than two weeks. The payment was approved in an emergency council meeting earlier this week.  
• The "Triple Threat" malware attack left Lake City’s phone and email systems inoperable. The city says it’s unclear how long it will take to get systems back online, but a full recovery is expected. 
• The city is only responsible for a $10,000 deductible thanks to insurance arranged through the Florida League of Cities. 

Dive Insight:

Lake City, a Jacksonville suburb with about 12,000 people, is the second Florida city this month to pay ransom after a hack. Last week, Riviera Beach paid $600,000 to restore its email system and public records, a controversial move that has prompted a national debate about how cities should handle the increasing frequency of cyberattacks. 

The FBI’s website says it "doesn’t support" paying ransom to hackers. While many cities have followed that advice, Lake City said that a consultation with its IT Director and a security vendor determined it was more cost effective to do so.

Baltimore recently refused to pay a $76,000 ransom to stop a malware attack, and Atlanta likewise did not give into hacker demands during a devastating attack last year. Both cities will likely end up paying millions to recover, which shows why some smaller cities would be eager to make the ransom payment. 

That has some experts fearful that the attacks will only accelerate, if hackers know they can get a reward. In an interview with CNBC, Mark Orland, chief technology officer for Raytheon’s Cyber Protection Solutions group, said ransomware is "much more lucrative today," adding "we definitely can expect more high-dollar payouts."

There is also concern over who cities are paying, since it is possible rogue states are behind the attacks. 

The surge in attacks has highlighted the need for more cybersecurity spending at the state and city level. Most local governments do not have dedicated cybersecurity staff and budgets, leaving them vulnerable to attacks. In an appearance before the U. S. House of Representatives Committee on Homeland Security last week, Atlanta Mayor Keisha Lance Bottoms said the federal government needed to offer more help to cities.

Washington, she said, should "expand programs that share real-time threat information" and should institute programs "to provide cybersecurity disaster-relief funding." That, she said, "will help offset recovery costs borne locally."