The City of Acworth, Georgia, documented network outages and possible service interruptions June 8, 2026, then confirmed June 18 that a cybersecurity incident had affected certain computer systems and that all systems were restored. INC Ransom later claimed the city, alleged possession of municipal data and threatened release, but Acworth has not confirmed the actor, data theft, ransomware, a demand or payment.
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Internal or external network connectivity was unavailable or materially impaired.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.
The actor explicitly threatened to publish or publicly release victim data or incident details.
The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.
DysruptionHub assesses with high confidence that the City of Acworth experienced a cybersecurity incident affecting municipal computer systems on June 8, 2026. The city’s June 8 service notice said customers might experience service interruptions because of network outages, but it did not identify a cyber cause.
Acworth first publicly confirmed the cyber incident in a separate June 18 statement. The city said certain computer systems were affected, it engaged cybersecurity professionals and notified law enforcement, and the investigation remained ongoing. The statement did not identify an initial access vector, malware family, compromised account or affected department.
INC Ransom listed Acworth’s official domain July 2. TechNadu reported that the listing included alleged samples, while separate public threat-intelligence reporting preserved the actor’s claim that it had obtained municipal data and would release the information if the city did not make contact. These are threat-actor allegations, not confirmation that INC Ransom caused the June incident or obtained authentic city data.
The documented operational effect was a network outage accompanied by the city’s warning that customers might experience service interruptions. The notice did not identify whether payments, permits, utilities, records, phones or other public-facing functions were unavailable, and the reviewed sources do not establish disruption to emergency services, policing, power delivery, water or sanitation.
The available evidence supports a partial municipal network and government-service disruption. It does not establish how many customers were affected, which systems were unavailable, how long individual interruptions lasted or whether the disruption resulted from attacker activity, defensive isolation or both.
Acworth’s June 8 notice acknowledged network outages and possible service interruptions without characterizing the event as cyber. The June 18 statement was the city’s first located public confirmation that a cybersecurity incident had affected computer systems. It also provided an authoritative operational all-clear, stating that all systems had been restored, city services were fully operational and day-to-day operations were no longer affected.
The later actor claim did not produce a corresponding city statement about ransomware, data theft or extortion. Acworth’s public record therefore confirms the incident and restoration but does not corroborate the claim’s technical or data-impact details.
The incident is resolved for operational tracking because the city expressly confirmed full system restoration and no continuing day-to-day impact June 18. The ongoing investigation and later threat-actor claim do not, by themselves, show continuing service disruption.
Confidence is high that the cyber incident occurred and that affected systems were restored because Acworth confirmed both points. Confidence is medium in the full operational scope because the city documented network outages and possible customer interruptions but did not name affected services.
DysruptionHub assesses INC Ransom attribution and ransomware or data-extortion involvement at medium confidence. The actor named the city’s exact domain soon after Acworth’s confirmed incident, claimed municipal data and threatened release, reportedly with alleged samples. That temporal and entity match is meaningful, but no authoritative source has verified the actor’s role, the samples’ authenticity, encryption, data theft, a demand, negotiation or payment.
Data impact remains unresolved. The actor’s claim and alleged samples do not establish that Acworth data was accessed, copied or published, and the city has not disclosed affected data categories, people or record counts.
The public record does not identify the initial access vector, exploited vulnerability, compromised account, malware or tooling, dwell time, persistence, affected hosts, restoration method or exact outage duration. It also does not establish whether attacker activity or defensive containment caused the network outages.
The record does not establish whether INC Ransom’s alleged samples were authentic, what data the group claimed to hold, whether a formal payment demand or negotiation channel was delivered to Acworth, whether the city communicated with the actor, whether any payment occurred or whether data was later released.
INC Ransom listed the City of Acworth’s official domain July 2, 2026, claimed to have obtained municipal data and threatened release if the city did not make contact. Public reporting said the listing included alleged samples. Acworth has not confirmed the actor, authenticity of the samples, data theft, encryption, a demand, negotiation or payment.
DysruptionHub reported that Acworth warned customers of possible service interruptions from network outages and later confirmed a June 8 cybersecurity incident affecting certain computer systems. The city said all systems were restored by June 18 and did not identify the affected services or technical cause.
In a June 8 operational notice, the City of Acworth warned that customers might be experiencing service interruptions because of network outages. The notice did not identify a cybersecurity cause, name affected services or provide a restoration estimate.
FOX 5 Atlanta reported June 20 that Acworth said a June 8 cybersecurity incident affected certain government computer networks. Cybersecurity professionals and law enforcement were engaged, affected networks were restored and municipal services were fully operational.
BreachSense recorded acworth-ga.gov as a July 3, 2026, data-breach claim attributed to INC_RANSOM. The listing is external claim evidence and does not establish that Acworth confirmed ransomware, encryption, data theft or attribution.
The City of Acworth said June 18 that it had recently identified a cybersecurity incident affecting certain computer systems on June 8. It engaged cybersecurity professionals and law enforcement, restored all systems and reported city services fully operational with no continuing day-to-day impact.
TechNadu reported that INC Ransom listed the City of Acworth’s domain on its dark-web leak site, with the claim discovered July 2 and accompanied by alleged samples. The report distinguished the actor’s listing from Acworth’s official confirmation and did not independently verify the claim.
Signed-in members can report an error, update, or missing source.
