Baltimore IT director who went on leave after ransomware attack is no longer employed with the city

Baltimore IT director Frank Johnson, right, who went on leave in September amid criticisms over his handling of the recovery from a crippling ransomware attack, no longer works for the city. His deputy, Todd Carter, left, continues to serve as acting director. They are shown in this file photo, answering questions during a meeting of the City Council's budget and appropriations committee.

Baltimore IT director Frank Johnson, who went on leave in September amid criticisms over his handling of the city’s recovery from a crippling ransomware attack, no longer works for the city.

Lester Davis, a spokesman for Democratic Mayor Bernard C. “Jack” Young, confirmed Monday that Oct. 1 was Johnson’s “separation date.” Davis declined to comment on the reasons for Johnson’s departure, saying it was a confidential personnel matter.


Davis said Todd Carter, the deputy IT director who stepped into the role of acting director when Johnson went on leave, is still serving in that capacity.

During a June 7 budget hearing, a month after the ransomware was discovered on city computers, Johnson apologized to City Council members for doing a poor job of sharing information with other agency leaders and residents in the aftermath of the attack.


“We will improve communications in situations like this,” Johnson said. “My sincere apologies.”

On the day of the attack, hackers demanded a ransom in bitcoins worth about $76,000 at the time, which Young refused to pay. The attack left city employees without access to their email, halted real estate sales in the city and held up water billing for months. Baltimore’s budget office estimates the attack will cost the city at least $18.2 million — a combination of direct costs and lost or delayed revenue.

Johnson was also at the helm of the IT department during a previous ransomware attack, which infected the city’s 911 systems in March 2018.

In an earlier interview with The Baltimore Sun, Johnson said he took measures to improve the city’s defenses after that incident and a ransomware attack that hit the city of Atlanta during the same month.

But in the aftermath of the latest ransomware attack on Baltimore’s computers, the city acknowledged it did not have a written plan to follow in the case of a serious incident. Nor did it have a cyber insurance policy, which has helped other cities, like Atlanta, defray the costs of recovery.

Maryland Policy & Politics


Keep up to date with Maryland politics, elections and important decisions made by federal, state and local government officials.

When Johnson joined the administration of then-Mayor Catherine Pugh in late 2017, he was the fifth person to run the office in three years and the highest-paid employee in the city with a salary of $250,000 a year.

During the most recent fiscal year ending June 30, Johnson was the second highest-paid after new Police Commissioner Michael Harrison, who makes $275,000 a year.

Acting IT director Carter, who joined the city May 6, makes an annual salary of $180,000.