By EMMA HURT, WABE

Atlanta city officials said the investigation following Thursday’s ransomware attack has moved into a restoration mode, though its timeline remains unclear. The attack continues to affect some city operations.

At a press conference Monday, Mayor Keisha Lance Bottoms said they remain “in a hostage situation” with the hackers and are working around the clock on the issue.

The city has brought in Sandy Springs cybersecurity firm, Secure-Works to help.

While the hackers have been identified, Secure-Works chief executive Michael Cote said they would not release that information.

The timeline to complete the investigation also remains unknown.

“This is a marathon,” Cote said at the press conference. “We’ve done a lot of work cooperatively across the last three or four days, and I think we’re making a lot of progress.”

Lance Bottoms said the attack has pushed cybersecurity to the top of her administration’s priority list.

“Just as much as we focus on our physical infrastructure, we need to focus on the security of our digital infrastructure,” she said. “This is new territory for us but we are a resilient city.”

She said all options are on the table regarding large-scale system improvements.

“We have some thoughts as to what our vulnerabilities are, but this is not just about a fix for today. This is about a fix for our infrastructure going forward.”

Following the attack, many online city services are still down, including the bill-pay function for water bills and parking tickets. City employees unable to turn on their computers, and the airport has shut down WiFi as a precaution. No failure to appear in court penalties will be administered during this time.

On Tuesday, the city announced that employees could restart their computers.

“Today, the City of Atlanta is advising its employees to turn on computers and printers for the first time since the March 22 cyberattack,” the city said in a press release. “It is expected that some computers will operate as usual and employees will return to normal use. It is also expected that some computers may be affected in some way and employees will continue using manual or alternative processes. This is part of the City’s ongoing assessment as part of the restoration and recovery process.  The City is also pleased to advise that the following systems are now available to employees: Email, Oracle, Siebel, Accela, and select services for employees in enQuesta (Note: Capricorn, the customer web portal is still not accessible).

“The City remains committed to staying open for business and operating on behalf of its residents. Additional updates will be provided as they are available.”

The city requests that for further information, people call 311 or the Office of Constituent Services at (404) 330-6023.

This story was provided by WABE.