Ransomware disrupted Albemarle County systems in June 2025, including internet access and GIS services. The county restored operations without paying and later confirmed compromised personal and health-plan information; INC Ransom attribution remains qualified.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Unauthorized access to systems, accounts, networks, or data.
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
The organization lost or materially restricted internet connectivity.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
A specific application or software platform became unavailable or unusable.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
An authoritative source stated that no ransom or extortion payment was made.
Albemarle County, Virginia, experienced a ransomware incident that began late June 10, 2025, and was discovered the next morning. The county’s July statement established that timeline and said it restored data from backups without paying a ransom. Our initial reporting described the government’s containment shutdown and service disruption before those findings were public.
The county’s June 12 announcement and June 18 update document internet loss at government buildings, followed by restoration of internet access while other system problems continued. GIS Web was among the public-facing resources still affected June 18. The outage also forced cancellation of a June 16 virtual public session on data-center regulations. County buildings and public safety services continued operating.
The Record reported phone-service effects associated with the incident. The underlying county phone notice was posted June 24 and updated June 25 to announce full restoration of incoming and outgoing calls. It described affected office and non-emergency lines, available online services and email alternatives. That post does not establish a continuous two-week telephone outage. It also mentions carrier-specific problems reaching 911; the evidence does not establish that those problems were caused by the county’s ransomware incident.
The county’s final FAQ says its systems were restored to normal. Operational disruption is resolved, but the exact full-restoration date remains unknown. Restoration of internet or phones was a component milestone, and subsequent data review and notification continued after operational recovery.
Confidence is high in the ransomware incident, disrupted services and unauthorized access to information because the county confirmed them. Its December notice identified affected employees, dependents, residents and other people who interacted with county services. The findings supersede the early uncertainty about whether personal information was involved.
The final FAQ distinguishes local-server data from cloud systems, for which the county found no indication of compromise. It also describes self-insured health-plan administrative information involving current and former local government and public school employees and their dependents. Some records included health and billing details, but the county said medical charts were not involved. Approximately 185 GB of compromised files underwent review; that figure is not an independently established volume of exfiltrated data, and the county’s access-and/or-acquisition wording does not resolve the disposition of every file.
Information Charlottesville attributes identification of INC Ransom to Daily Progress reporting. That provides support for a qualified attribution, but the reviewed county notices do not identify the perpetrator. A tracker entry naming the school district’s domain does not independently establish responsibility for the county-government incident.
The initial-access method, precise encryption scope, complete affected-person count and exact recovery date remain unresolved. The county’s nonpayment statement is established; it does not by itself establish deletion of any acquired data. The duration and cause of every reported telephone problem also remain uncertain.
Information Charlottesville, citing July 14 Daily Progress reporting, identifies INC Ransom in connection with the county ransomware incident. The county’s reviewed notices do not name the actor. A separate INC Ransom listing names k12albemarle.org; that school-domain listing does not independently establish county-government attribution or a county theft volume. Responsibility remains unconfirmed.
County government remit. Documented disruption affected specified county systems and services; it does not establish a simultaneous outage in every community.
County offices on McIntire Road in Charlottesville were affected. The city is a separate jurisdiction, not a county government victim.
Our original report describes containment internet shutdown, delayed services and canceled virtual public meeting.
County acknowledges cyber incident, offline internet and service impacts; June18 update says internet restored but GIS Web/system issues continue.
County canceled June16 virtual public session because incident response left internet unavailable; in-person alternative scheduledJune30.
County facilities and non-emergency phones affected; June25 update says incoming/outgoing calls restored at all locations.
County confirms ransomware, June10–11 timeline and backups; says no ransom paid and data review ongoing.
Reporting summarizes ransomware/data finding and phone effects and links underlying county social notices.
Final investigation finds unauthorized access involving employees, dependents, residents and other individuals; around185GB of compromised files reviewed.
Sean Tubbs reports final county findings and references Daily Progress reporting identifying INC Ransom; also notes GIS and Development Dashboard effects.
Final FAQ reports systems restored to normal and explains health-plan administrative data findings; no exact restoration date.
Signed-in members can report an error, update, or missing source.
