Ransomware disrupted Box Elder County government systems in August 2025, forcing manual land-record processing and restricting online access. The county later confirmed data theft and publication and said it refused to pay a ransom.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Unauthorized access to systems, accounts, networks, or data.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Stolen, exposed, or otherwise compromised data was publicly released, posted, distributed, or offered for download.
Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Backup data or backup systems were accessed, encrypted, deleted, altered, disabled, or otherwise compromised.
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Services continued but with longer processing, response, delivery, or completion times.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
The extortion activity involved unauthorized encryption of systems or data, with restoration or decryption conditioned on payment.
The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.
The actor directly contacted the victim through a ransom note, email, chat portal, telephone call, messaging platform, or other communication channel.
A dedicated portal, chat system, or communication channel was used for ransom negotiation or victim instructions.
An authoritative source stated that no ransom or extortion payment was made.
Box Elder County, Utah, detected ransomware on Aug. 3, 2025. Its December public notice establishes intermittent unauthorized access from May 6 through Aug. 3, theft of county data and subsequent online publication after the county refused to pay. The notice identifies potentially affected personal, financial, identification and health information; the categories vary by individual.
The county first publicly acknowledged the incident Aug. 6. We reported the disruption Aug. 7, following local coverage of unusable government computers and service delays. Our observation of a website certificate error does not independently establish that the attack caused that particular error.
In a March 2026 account of the recorder’s conference presentation, Chad Montgomery described unavailable online deed access on Aug. 4 and manual recording after ransomware affected computers, servers and off-site backups. Transactions that normally took minutes took substantially longer. Staff rebuilt systems, and his office worked for weeks using one laptop, a printer, scanner and mobile hotspot.
The Aug. 14 county update described locked systems, restoration efforts and possible continuing service disruptions. These effects support material government-service impairment without implying that every county function stopped. The county said election processes remained secure and tabulation equipment was disconnected from its network.
Ransomware, data theft, publication and refusal to pay are confirmed by the county. Interlock’s responsibility remains a claim: Comparitech’s original Aug. 13 report describes a leak-site listing, samples and allegations of 4.5 terabytes and approximately 2.1 million files. County confirmation of theft does not independently verify the actor or those quantities.
The recorder’s account supports encryption of backups and prolonged manual operations. Its approximate four-and-a-half-month dwell-time statement differs from the formal notice’s May 6 access-window start; the formal chronology is used. No reviewed evidence establishes the initial entry method, a specific exploited vulnerability or a compromised supplier.
A precise restoration sequence, final technical completion date, complete system inventory and total response cost remain unestablished. Comparitech later reported 81,664 notified people, attributing the figure to Maine’s attorney general; the linked filing could not be retrieved, so that total remains attributed reporting rather than a directly verified filing result.
The county completed its data review Nov. 17 and issued notices Dec. 17. These are investigation and notification milestones, not evidence that operational disruption continued until those dates.
Operations are presumed resolved based on elapsed time since the dated August disruption evidence. Aug. 14 is the latest precise contemporaneous recovery observation found; later testimony describes weeks of impairment without a precise final day. No affirmative complete-restoration statement or exact end date was found.
Comparitech’s explicitly dated original August 13, 2025 report describes Interlock listing Box Elder County and publishing alleged samples, claiming 4.5 TB and about 2.1 million files. The county later confirmed ransomware, theft and publication, but did not identify Interlock or verify these volumes. Attribution remains low confidence. MCP name/domain searches returned no matching lead; no discovery timestamp or unvisited leak URL is invented.
The county jurisdiction supplies service context for impaired government systems and records services. It does not imply every resident, municipality or election process was disrupted.
Brigham City is the county headquarters and affected government-office site anchor. This does not identify the separate city government as compromised.
Signed-in members can report an error, update, or missing source.
