Chelan County malware disrupts government systems

Analyst assessment

DysruptionHub assesses with high confidence that Chelan County, Washington experienced a confirmed malware incident affecting its county government network beginning May 24, 2026. Chelan County’s department update said the county became aware of malware in its network environment and shut down the network while investigating the nature and scope of the event. DysruptionHub’s published report documented that computers and telephone systems were taken offline across county departments while 911 remained available.

The response was broader than isolation of a single device or application. Networks, computers and phones were shut down, and subsequent updates described an extended system-wide disruption affecting email, telephone service, Internet access and electronic records. The county worked with third-party security specialists and reported the incident to federal law enforcement.

Operational significance

The incident materially affected routine county business. Public reporting and county updates described unavailable phone and email systems, inaccessible records and temporary alternatives for contacting offices. Some departments established temporary telephone numbers and external email accounts.

The disruption also created substantial downstream delays. The county’s department update said the Clerk’s Office accumulated more than 6,000 documents while systems were unavailable and regained access to state document-management systems on June 22. The office estimated that processing the backlog could take about a month and warned of delays in responses to calls and email.

Emergency communications were not reported as fully unavailable. The initial county notice said 911 remained operational, which limits the supported public-safety impact. The record nevertheless establishes broad administrative disruption and prolonged impairment of normal government communication, records and processing channels.

Disclosure posture

Chelan County publicly acknowledged both the cyber cause and the operational consequences. Its statements identified malware, described the precautionary shutdown, explained that an investigation was underway and provided department-specific service updates. The disclosures did not identify the malware family, entry vector, affected hosts or whether data was accessed or removed.

Current status

Recovery occurred in stages. In a June 23 update, Chelan County said phones, employees’ desk computers and email had returned to workable conditions, offices were open and county websites had been back since June 15. It also said the county was still working to restore all systems, the deliberately cautious recovery was continuing and the investigation remained open.

The Clerk’s passport information page, updated July 8, still attributed a technology outage to the May 24 malware incident. It said the Clerk’s network had only begun recovering with state systems on June 22, passport appointments would reopen in the latter half of July and walk-in processing remained limited while staff caught up.

Because direct official evidence still documented incident-related service constraints on July 8, DysruptionHub assesses the incident as presumed active as of August 3, 2026. This status reflects continuing recovery, backlog and reduced service capacity; it does not mean malware was known to remain active in the environment.

Confidence and uncertainty

Confidence is high that malware caused a material countywide disruption because the affected organization confirmed both the malicious software and the shutdown of county systems. Confidence is medium on the complete technical scope because no forensic report, final investigative finding or comprehensive restoration report has been published.

The public record does not confirm ransomware. It also contains no known extortion indicator: no ransom demand, extortion communication, leak-site claim or payment was identified. Data impact remains unresolved because the county’s updates do not establish whether information was accessed, copied, altered, deleted or exposed.

Analytic gaps

The public sources do not establish the initial access vector, vulnerability exploited, compromised account or device, malware family, dwell time, persistence method or number of affected systems. They also do not identify whether credentials were stolen, whether data was exfiltrated, whether backups were affected, or when every department returned to normal operations. A final all-clear, full restoration date and investigative conclusion were not found.