Catawba County, North Carolina, identified unauthorized network activity Sept. 19, 2025, later placing the event between Sept. 12 and 19. Its website was unavailable for several days and returned Sept. 22; the county has not expressly linked that outage to the attack. The county later warned that personal and health information could have been affected. Emergency response and public safety services remained operational.
We reported Oct. 23, 2025, that the Catawba County website had been unavailable for several days before returning Sept. 22. At that time the county had not identified a cyber cause. A later county disclosure confirms unauthorized activity on its computer network discovered Sept. 19 and places likely activity between Sept. 12 and 19. This establishes a cyber incident involving the same government during the website outage window, but the county has not explicitly stated that the attack caused the website outage. The operational linkage remains suspected, not confirmed.
The October report documented a maintenance banner and 404 errors on county pages, including the sheriff’s office, until the site returned Sept. 22. The county says emergency response and critical public safety services remained operational throughout the cyber incident. The government jurisdiction is Catawba County, with its Government Center in Newton; no physical building outage is established.
The county’s later investigation found that certain personal or health information could have been subject to unauthorized activity, potentially including names, dates of birth, Social Security numbers, financial account details and medical or health insurance information. It reported no known misuse at the time of the notice. Local reporting said 128,000 letters were sent to potentially affected people or descendants, and a county spokesperson said no ransom was paid. The October article linked a Qilin victim listing; the county has not confirmed that actor, ransomware deployment or a link between the listing and website outage. The exact affected-person count, exfiltration and intrusion method remain unconfirmed.
Qilin listed Catawba County Government on its leak site, indexed Oct. 14, 2025. The county confirmed a cyber event but did not attribute it to Qilin or establish ransomware deployment or exfiltration. The listing is a low-confidence attribution claim.
County service jurisdiction; not every facility was affected.
County Government Center place anchor, not a confirmed building outage.
County website was offline for several days before Sept. 22 restoration; maintenance banner and 404 pages included sheriff pages. Qilin later listed county, but county had not then confirmed cause.
Government Center is at 25 Government Drive in Newton, North Carolina.
County spokesperson said no ransom was paid; 128,000 notification letters were sent; emergency systems were not compromised.
County identified unauthorized network activity Sept. 19, 2025; investigation placed it Sept. 12–19 and found personal or health information could have been subject to unauthorized activity. Emergency and public safety remained operational.
Qilin-linked listing names Catawba County Government; county confirmation of Qilin, ransomware deployment or data theft was not found.
Signed-in members can report an error, update, or missing source.
