City of Angleton
Angleton cyberattack disrupted payments and court services
Summary
A cyberattack disrupted online utility payments and municipal court activity in Angleton, Texas, in summer 2025. Official filings acknowledged the attack, while the precise intrusion and complete recovery dates remain unestablished.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Angleton, Texas, identified a cyberattack in official catastrophe filings associated with disrupted municipal services in summer 2025. The initial state catalog record identifies the city, its secretary and a cyberattack-related suspension of public-information deadlines for July 28–Aug. 4. An extension covers Aug. 5–12 and explicitly links the initial filing.
These are administrative suspension windows. They establish the city’s acknowledgment of a cyberattack, but do not independently establish the intrusion’s first day, the full duration of technical disruption or a restoration date.
Operational significance
We reported Aug. 18 that online utility payments were unavailable and municipal court activity had been canceled, with cash or money orders required for court payments. Residents were being told of an internet outage. The report documented phone/card and night-drop payment alternatives for utility customers.
The disruption affected access to routine municipal transactions and public-information processing. The reviewed evidence does not establish interruption of water treatment, water delivery or emergency response. Alternate payment arrangements preserved some access while online services were impaired.
Confidence and uncertainty
Confidence is high that this was a cyber-related municipal disruption because the state’s records identify a cyberattack and contemporaneous reporting documents concrete service effects. Ransomware remains unresolved: no reviewed evidence establishes encryption, an extortion demand, a named attacker, data theft or payment. Searches of the available ransomware-lead service by city name and official domain returned no matching claim.
The public-information filings and public outage messaging provided different levels of detail. That difference does not establish a specific technical cause, intentional concealment or a complete public disclosure chronology.
Analytic gaps
The precise intrusion and detection dates, affected systems, entry method, data exposure, response costs and exact recovery date remain unestablished. Official catalog records identify the cyberattack and the suspension dates, but do not establish technical onset or recovery.
Aug. 18 is the earliest verified public cyber report in the reviewed material. Earlier public outage notices or dated publication of the official filings could clarify when the city first publicly identified cyber involvement.
Operations are presumed resolved based on elapsed time since the Aug. 18, 2025 observation of continuing disruption. No affirmative complete-restoration statement was found. Current official service links do not establish when historical systems returned, and the Aug. 12 end of the records-deadline suspension is not treated as technical recovery.
Organizations involved
Impacted location
Angleton, Texas
Angleton is the municipal administrative site anchor for affected payment and court services. Preserves the existing municipality rather than inventing a specific compromised facility.
The city jurisdiction supplies governmental service context for utility-payment, court and public-information disruption. This does not establish that every resident or physical water-delivery system was affected.
Sources
Our reporting documented unavailable utility payments and municipal court cancellations, while the city’s catastrophe filing identified a cyberattack.
The city extended the cyberattack-related public-information deadline suspension through Aug. 12, 2025.
The city identified a cyberattack as the reason for suspending public-information deadlines July 28–Aug. 4, 2025.
See something that needs correction?
Signed-in members can report an error, update, or missing source.