Following detection of a network breach, City of Johannesburg shut down its website, e-services platform and billing systems and launched an investigation into the source of the attack. Although none of the files was encrypted the attackers - Shadow Kill Hackers - demanded four bitcoins (around $30,493) to be paid until October 28. Otherwise, they will publish all passwords and sensitive data such as finance and population information they have compromised.
Over the last several days the municipality has been attempting to restore critical systems and on October 28 they decided not to pay the ransom. Whether the attackers will make any data public remains to be seen.