Skip to content
DysruptionHub
Sign in Subscribe

Atchison County

Summary

Atchison County logo

A network cyber incident closed Atchison County, Kansas, offices for three days in March 2025. Phased reopening began March 20, but vehicle-registration processing still faced a backlog, intermittent outages and longer waits April 4. Emergency services continued operating.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
Unresolved

Attack mechanisms

  • Unknown cyber mechanism

    The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.

Data impacts

  • Unknown data impact

    The incident is cyber-related, but available evidence does not establish whether or how data was affected.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Degraded service

    Services remained available but with reduced performance, reliability, functionality, capacity, or responsiveness.

  • Intermittent service disruption

    Services or systems experienced recurring, unstable, or temporary periods of unavailability.

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Transaction processing disruption

    Business, financial, customer, administrative, or operational transactions could not be completed normally.

  • Records processing disruption

    The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.

  • Government services disrupted

    Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.

  • Facility closure

    One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Backlog created

    The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.

  • Alternate service channel required

    The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

  • Customer or public access restricted

    Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.

Extortion indicators

  • No known extortion indicator

    Available evidence indicates that no extortion demand, threat, communication, or related pressure tactic was identified.

Incident narrative

Analyst assessment

A cyber incident affecting Atchison County’s computer network interrupted county government business in Kansas in March 2025. In its March 16 statement, the county said it had recently detected and responded to the incident and would close offices to the public March 17 while working to secure and restore systems. It engaged nationally recognized cybersecurity and data-forensics consultants and notified the state. March 16 is the earliest documented public acknowledgment; the actual intrusion date was not disclosed.

Operational significance

Offices remained closed through March 19. MSC News reported March 20 that offices were reopening after three days, with public-facing systems returning in phases. The county warned that processing delays could continue and asked residents to call before visiting. The commission’s March 18 meeting was limited to in-person attendance. The county explicitly said 911, fire and emergency resources continued operating.

Recovery extended beyond reopening the buildings. In an April 4 update, the county treasurer said motor-vehicle transactions could again be processed, prioritizing expired renewals and purchases more than 60 days old. Residents with current April renewals or newer purchases were asked to wait so staff could address overdue registrations. The office still reported intermittent outages involving the state system and longer-than-average waits. That establishes continuing service limitations; it does not establish that state infrastructure was compromised.

Confidence and uncertainty

Official acknowledgment supports high confidence that this was a cyber incident with operational disruption. The mechanism, initial access route and perpetrator remain undisclosed. Reviewed sources do not establish ransomware, encryption, data theft, a public leak or an extortion demand. The absence of a matching public claim in the searches performed does not establish that none existed.

The incident is assessed as presumed resolved because the documented disruption is historical and services were returning, but complete recovery has not been positively dated. April 4 is the latest verified impact date in the reviewed evidence. No exact end date is supported.

Analytic gaps

Public evidence does not establish the full set of affected systems, investigation findings, costs, data consequences or the date normal processing resumed. The county’s separate late-2025 CodeRED vendor incident is excluded from this assessment.

Organizations involved

Impacted locations

  • Atchison County, Kansas

    County commissioner responsibilities at https://atchisoncountyks.org/2/Commissioners cover residents inside and outside city limits; county treasurer https://www.atchisoncountyks.org/5/Treasurer provides countywide tax and registration functions. Atchison County is the governmental remit of the affected county administration, paired with the separate Atchison office-site anchor. This overlay does not assert an outage at every address, every department or emergency services, which the county expressly said continued.

    Source

  • Atchison, Kansas

    Official county courthouse/commissioner/treasurer pages https://www.atchisoncountyks.org/5/Treasurer and https://atchisoncountyks.org/2/Commissioners locate offices at 423 N. 5th Street, Atchison, Kansas 66002. Exact Census address match confirms Atchison city GEOID 2002900 within Atchison County 20005. Existing Atchison municipality anchors affected county offices; this does not imply all city premises or municipal government systems were disrupted. Original March 16 statement documents the county-office closure. Exact OSM relation 130074 is the Atchison administrative municipality; no loose coordinates or bounds supplied.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.