City of Abilene, Texas, ransomware attack
Summary
An April 18, 2025, ransomware attack disrupted Abilene’s network, payments and records work. The city rebuilt systems, refused ransom demands and maintained essential services.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
-
Credential compromise
Theft, exposure, or abuse of user or administrator credentials.
Data impacts
-
Data encryption
Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.
-
Data deletion or destruction
Data was intentionally deleted, wiped, destroyed, or made permanently unrecoverable.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Backlog created
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
Ransom demand
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
-
Encryption-based extortion
The extortion activity involved unauthorized encryption of systems or data, with restoration or decryption conditioned on payment.
-
Public leak threat
The actor explicitly threatened to publish or publicly release victim data or incident details.
-
Leak-site listing
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
-
Countdown or payment deadline
The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.
-
Direct victim contact
The actor directly contacted the victim through a ransom note, email, chat portal, telephone call, messaging platform, or other communication channel.
-
Payment denied
An authoritative source stated that no ransom or extortion payment was made.
Incident narrative
Analyst assessment
The City of Abilene, Texas, detected unresponsive internal servers April 18, 2025, and disconnected affected and critical assets. Its April 21 statement documented an investigation, outside cybersecurity assistance and service limitations. Later reporting quoting city IT and risk officials confirmed ransomware, encrypted and deleted data, and a decision to rebuild the network. Cyber involvement and ransomware are assessed with high confidence.
Operational significance
The initial outage disabled in-person card payments and slowed telephone, email and service-request responses. Cash and check payments remained available in person, and online municipal-services payments continued accepting cards and electronic checks. Emergency response and essential utility operations continued; billing and administrative disruption should not be confused with a loss of water or wastewater service.
The Texas attorney general’s initial catastrophe notice and extension document suspended public-information response requirements from April 22 through May 5. These legal windows do not establish technical recovery.
By June 2, officials described temporary computers, replacement of servers, storage, desktops, laptops and desk phones, and workarounds while systems were restored. Full functionality was then expected to take months. The city’s original social update acknowledged continuing recovery and community disruption while essential services had continued.
The FY2026 budget records delayed citation collections, disruption to budget preparation and a cyber-related vital-records backlog that was later cleared. Its FY2025 revisions included $1.5 million for response, with a warning that the provision could increase. This is budgeted funding, not a verified final loss or expenditure total. The projected return of the citation system in the first quarter of FY2026 is a forecast rather than a confirmed recovery date.
Later city accomplishments reporting describes the cleared vital-records backlog, a cloud transition for municipal-court case management, and IT restoration and stabilization. The historical operational status is presumed resolved, but no universal restoration day has been verified. The end date remains unknown.
Confidence and uncertainty
Named city officials described compromised administrative credentials and attempts to remove antivirus protection. These findings do not establish how the attackers first entered the network, and no specific vulnerability or phishing method is confirmed.
Qilin was publicly associated with the incident in reporting the city acknowledged. A Qilin-attributed tracker listing matches the city’s domain but contains a description of the Abilene Housing Authority. That inconsistency remains unresolved. Confidence in Qilin’s responsibility is low; the listing does not establish that the housing authority was part of this city-network incident.
The 477-gigabyte theft volume and May 27 publication deadline are attributed claims. The city’s refusal to pay is documented, while the exact information taken, any eventual publication or misuse, and final data findings remain unverified. Confirmed encryption and deletion are distinguished from the claimed theft.
Analytic gaps
The exact initial-access route, complete data scope, final response costs and a universal restoration date remain unresolved. Ransomware.live’s May 16 discovery timestamp is not the original claim-publication date. Forecasts and budget provisions do not substitute for dated operational recovery or actual spending records.
Threat actors and claims
Claim details
A Qilin-attributed tracker listing identifies abilenetx.gov, the City of Abilene, Texas, domain, and threatens data publication May27. Its descriptive text instead refers to the Abilene Housing Authority; that metadata inconsistency remains unresolved. Independent local reporting says the city acknowledged a Qilin claim and refused payment, but the original leak post, original claim-publication time and full data scope are not verified. Confidence in responsibility is low. The claimed477GB volume is not a confirmed forensic measurement. The May16 timestamp is tracker discovery, not the attack or publication date; no separate housing-authority, school-district or medical-office incident is merged.
Organizations involved
City of Abilene
Location
Organization type
Critical infrastructure
Impacted location
Abilene, Texas
Abilene contains City Hall and the affected municipal offices. City Hall’s555WalnutStreet address is identified in the city budget and matches Census Abilene4801000/TaylorCounty48441. This is a physical city anchor, not evidence of an outage at every local facility.
The affected municipal government serves Abilene, including portions of Taylor and Jones counties. This overlay records its municipal remit; emergency response and essential utility services continued.
Sources
We reported the April 18 network incident, isolated systems, limited payments and delayed city communications.
The city identified unresponsive servers April18, isolated affected assets and engaged investigators. In-person card payments were unavailable, responses were slower and essential emergency services continued.
Named city officials confirmed ransomware, encrypted and deleted files, network rebuilding and refusal to pay. The report separates a 477GB theft claim from unresolved data contents and describes temporary replacement computers.
City officials described ransomware, compromised administrative credentials, encrypted and deleted data, and replacement of servers, storage and employee computers. Core services continued while restoration was expected to take months.
The city acknowledged recovery work, community disruption and the continuation of essential services, and directed residents to a detailed incident overview.
The official notice identifies a cyberattack and suspends the city’s public-information response requirements from April22 through April28.
An extension continued the public-information response suspension through May5, following the April22–28 notice.
The budget records continuing response, delayed court collections, a cleared vital-records backlog and uninterrupted essential utility service. FY2025 revisions included a $1.5million response provision that could increase.
The tracker lists the city’s abilenetx.gov domain under Qilin, with a May27 publication threat. Its description instead refers to the Abilene Housing Authority, creating an identity inconsistency.
The city reported elimination of its cyber-related vital-records backlog, transition of municipal-court case management to the cloud and continued IT restoration and stabilization work.
See something that needs correction?
Signed-in members can report an error, update, or missing source.