City of Attleboro 2025 cybersecurity incident

Analyst assessment

DysruptionHub assesses with high confidence that the City of Attleboro experienced a cyber incident in November 2025. The city said on Nov. 20 that a cybersecurity incident had taken several information technology systems offline. Its subsequent FAQ said officials detected suspicious network activity on or about Nov. 20 and immediately disconnected affected systems. The public record does not establish when the underlying activity began or whether the disruption resulted from the activity itself, containment measures, or both.

Operational significance

The initial city notice said internal email was unavailable across departments and nearly all municipal and police phone lines were out of service. City Hall remained open, but staff used paper forms and accepted offline bill and tax payments. Officials warned that some tasks would be delayed while employees used temporary procedures.

The city said 911, public-safety radio systems and police and fire business lines continued working. Dispatchers made manual adjustments, but police and fire continued emergency response, and mutual-aid communications remained available. Attleboro Public Schools were not affected. The disruption therefore centered on municipal administration and routine public contact rather than a documented interruption to emergency response or instruction.

Disclosure posture

Attleboro publicly identified the event as a cybersecurity incident in its Nov. 20 statement. Mayor Cathleen DeSimone later described continuing restoration work and said outside specialists were helping city IT staff investigate the scope and strengthen defenses. The city did not identify a specific intrusion method or actor in those statements.

Retrospective note

A city FAQ said all phone lines were operational, but did not give a restoration date. The city’s March 17 capital improvements plan labeled a proposed $100,000 firewall expansion and redundancy project for fiscal 2027 as urgent following the cyber incident. It also described a phased cybersecurity infrastructure overhaul for fiscal 2027-2029 as a direct result of the incident; its cost was not yet determined. These are planned security investments, not a reported cost of restoring affected services.

In a March 30, 2026, update, the city said the incident had been quickly contained and posed no ongoing threat to city systems. Its forensic investigation remained underway. Mayor DeSimone told The Sun Chronicle in July that the city’s insurance covered outside forensic, public-relations and legal services, and that it had increased its cyber-insurance coverage from $1 million to $3 million effective July 1. Those policy limits do not establish the cost of the incident.

The Sun Chronicle reported Sept. 24 that municipal phone and email service had been restored. The mayor told the newspaper Sept. 22 that the investigation remained open and she hoped to have a final report soon. The available statements support an end to the acute communications disruption but do not establish precisely when every affected service returned or provide a system-by-system all-clear.

The city’s fiscal 2027 proposed budget adds administrative recovery detail. The auditor’s fiscal 2026 accomplishments describe rebuilding information as needed after the cyber incident, while meeting required federal audit-report and financial-statement deadlines. The incident delayed a plan to decentralize the warrant process, carried forward as a fiscal 2027 objective. The document does not establish that records were permanently destroyed or specify when this work occurred.

The budget also lists security improvements implemented after the November attack: modernized cloud infrastructure, stronger email security, multifactor authentication, and endpoint and managed threat detection and response. Proposed fiscal 2027 subscription funding would sustain products procured after the attack. The proposed funding is not a verified total incident cost or evidence of renewed service disruption.

Confidence and uncertainty

Confidence is high that a cyber incident and operational disruption occurred because the city directly documented suspicious network activity, system shutdowns and service effects. The Sun Chronicle reported that Police Chief Kyle Heagney said early in the investigation that ransomware was possible. The city has not confirmed encryption or a ransom demand, and searches for the city name and domain found no stable ransomware or extortion victim claim. Ransomware and threat-actor attribution remain unresolved.

Data exposure also remains unresolved. Heagney said early in the investigation that officials had found no evidence resident data was stolen or transferred, according to The Sun Chronicle. That preliminary finding does not settle the outcome: the city said in March it was reviewing information that may have been involved and would notify individuals if needed, and the mayor said the investigation was still open in September. No final public data-impact finding has been identified.

Analytic gaps

The public record does not identify the initial access vector, affected account or host, malware, attacker dwell time, data categories, number of affected people or a responsible group. It does not establish the restoration date for email or other affected systems, or provide a final forensic finding on personal information.