Loading story…
The City of Coweta, Oklahoma said a ransomware attack caused a system-wide outage across city computers, files, and computer-based services, disrupting municipal operations while leaving the city website and a third-party online billing portal accessible. Officials said the intrusion affected city systems broadly, prompting an immediate response with the city's contracted IT provider and additional cybersecurity professionals to secure the environment, contain further intrusion, and begin recovery efforts.
City officials said the Coweta Police Department and Fire Department were not affected because they operate through off-site systems, and emergency services including 911 remained operational throughout the incident. The city also said it has an offsite backup and plans to use it to restore data once systems are cleared and deemed safe for recovery.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
In its public notice, the City of Coweta said it had retained specialized legal counsel and reported the ransomware incident to local and state authorities, while federal reporting was underway. These steps were disclosed as part of the city's response to the August 5 attack.
The city issued a statement dated August 7 saying it was responding to the ransomware attack and that an offsite backup exists for restoring data once systems are cleared and safe to recover. The statement also confirmed ongoing outages to city computers, files, and computer-based services.
After discovering the attack, the city immediately contacted its contracted IT provider and brought in additional cybersecurity professionals. Their response focused on securing systems, preventing further intrusion, and beginning recovery efforts.
City of Coweta, Oklahoma said a system-wide ransomware attack occurred on Wednesday, August 5, affecting all city computers, files, and computer-based services. The city website, third-party online billing portal, and off-site police and fire systems remained unaffected, and 911 services stayed operational.
City of Coweta said it would not pay the attackers' ransom demand following the system-wide ransomware attack. The decision was reportedly influenced by the city manager's prior experience with another municipality that paid a ransom and was reinfected weeks later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecityofcoweta-ok.gov
Open sourcemalware.news
Open sourcedysruptionhub.com
Open sourcemalware.news
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The City of Dallas said the **Royal** ransomware gang gained access to municipal systems on April 7, 2023, spent weeks conducting surveillance, and exfiltrated about **1.17 TB** of data before launching ransomware at 2 a.m. on May 3. The attack damaged hundreds of servers and more than a thousand endpoint devices, disrupting critical city operations including public safety dispatch, with police and ambulances reportedly sent to incorrect locations. Dallas activated its incident response plan, brought in outside cybersecurity firms, and coordinated with the **FBI** and **CISA**; more than 90% of affected services were restored within 18 days, and the city later approved **$8.5 million** for recovery and breach-notification work. Reporting on the incident said the intrusion exposed longstanding technical debt inside city systems, including outdated and unsupported software that increased risk despite recent gains in cybersecurity staffing and spending. The disruption echoed earlier ransomware damage in Atlanta, where city networks were hobbled by an attack linked to **SamSam**, forcing widespread shutdowns and recovery efforts with federal and private-sector assistance. Together, the incidents show how major U.S. municipalities remain high-value ransomware targets when internet-facing systems, patching gaps, and legacy infrastructure leave essential public services vulnerable.
Jun 29, 2026
Leduc County experienced a deliberate ransomware attack on December 25, which disabled several of the county’s information technology systems. The incident led to the proactive shutdown of additional IT services as a precaution during an ongoing forensic investigation. Key stakeholders, including the RCMP, insurance, and banking providers, were notified, and affected services included the county’s email platform, safety codes permits, development permits online portal, and website form submissions. Authorities responded quickly to the incident, with the RCMP receiving a report on Christmas Day. County officials stated that the attack was detected early, allowing for rapid engagement of cybersecurity experts and containment measures. Preliminary findings suggest minimal information was compromised, and the county is working to restore normal operations, though no timeline has been provided. Updates will be communicated to residents and stakeholders as the investigation progresses. No threat actor has claimed responsibility for the attack at this time.
Jul 12, 2026
The **University of Mississippi Medical Center (UMMC)** reported a **ransomware attack** that knocked multiple IT systems offline, including access to its *Epic* electronic health record (EHR) platform, triggering the organization’s emergency operations plan. The disruption forced UMMC to **close all 35 clinics statewide** and **cancel outpatient, elective, and clinic procedures**, while hospital and emergency services remained open under contingency operations. UMMC stated the attackers have been in communication and that it is working with external specialists and law enforcement; the **FBI is investigating** and warned the duration of the outage was unknown at the time of reporting. Separate reporting also described a different municipal incident in **Meriden, Connecticut**, where officials took city internet services and public Wi‑Fi offline after an attempted disruption; emergency services were reported as unaffected and the city said it would conduct a comprehensive review before restoring service.
Jun 29, 2026