City of Circleville
City of Circleville Ransomware Incident
Summary
The City of Circleville, Ohio, confirmed ransomware activity affecting portions of its municipal technology environment. The city said operations were restored, affected systems were rebuilt or recovered, no ransom was paid and it was not aware of evidence establishing that sensitive information was exfiltrated. The exact incident and detection dates remain unresolved.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
DD-CIT assessment
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
Extortion indicators
-
Payment denied
An authoritative source stated that no ransom or extortion payment was made.
Incident narrative
Analyst assessment
DysruptionHub assesses with high confidence that the City of Circleville experienced a confirmed ransomware incident affecting portions of its municipal technology environment. Mayor Michelle Blanton’s Aug. 26 statement said the city and its technology provider isolated systems, investigated potentially affected devices and began recovery operations after detecting ransomware activity.
The statement said affected systems were rebuilt from clean environments or recovered through established procedures and reviewed before returning to service. It does not identify the ransomware family, initial-access method, responsible actor or exact detection date.
Operational significance
Circleville said portions of its technology environment were affected and that systems required isolation, rebuilding or recovery. That establishes disruption to internal municipal technology, but the public record does not identify particular public services, departments or applications that became unavailable or delayed.
A Teays Valley Against Overgrowth account of an Aug. 25 Pickaway County commissioners meeting reported that county EMA Director Tiffany Nash said the incident affected the Police Department and the city. That account indicates Police Department technology may have been within the affected environment, but it does not identify the systems involved or establish interruption to police, dispatch or other public-safety operations.
Confidence and uncertainty
Confidence is high that ransomware activity occurred because the mayor’s statement expressly confirmed it and described containment, rebuilding and recovery. The exact incident start, detection date and restoration date remain unresolved. The TVAO account reported an Aug. 14 incident date, but no published county minutes or meeting recording independently corroborated that account.
The city said it did not pay a ransom. The statement did not say whether the city received a ransom demand, identify payment instructions or describe negotiations. Our Aug. 27 reporting found no current ransomware or data-extortion group claim for the City of Circleville or circlevilleoh.gov; an older LockBit claim concerned a separate 2023 incident at Circleville Municipal Court and is not attributed to this event. A negative search result does not establish that no claim exists.
Data impact remains unresolved. The city said it was not aware of evidence establishing that sensitive information was exfiltrated, but the investigation remained open. That finding does not establish whether files were encrypted, viewed, altered or otherwise affected during the incident.
Analytic gaps
The public record does not identify the exact incident or detection date, ransomware family, initial access vector, exploited vulnerability, compromised account or device, dwell time, encryption scope, ransom-demand details, affected data categories or responsible actor. It also does not establish the number of rebuilt systems, the exact restoration date, which Police Department systems were affected or whether any named municipal service experienced an outage or delay.
Disclosure posture
Circleville’s first verified public cyber disclosure is the mayor’s Aug. 26 statement confirming ransomware activity and restored operations. The statement provided strong confirmation and recovery information while withholding technical details to protect system security and the continuing investigation.
The TVAO account said Ohio Homeland Security and the Ohio Cyber Integration Center alerted Nash after the event and that she then helped connect the city with state officials. That supports an apparent intergovernmental coordination gap, but it does not establish that the city violated a notification requirement.
Current status
The incident is resolved operationally based on the city’s statement that operations had been restored and affected systems had been rebuilt or recovered and reviewed before returning to service. The investigation and post-incident security review remained ongoing, but those continuing activities do not by themselves establish continuing service disruption.
Revision note
This profile previously attributed an Aug. 6 Reddit alert to Circleville. A matching post by the same account explicitly identified Lancaster, Ohio, so the alert and the date and service-impact details that depended on it were removed from this record and reassigned to the City of Lancaster ransomware incident. Circleville’s verified public timeline now begins with its Aug. 26 statement, while the exact incident start remains unresolved.
Organizations involved
Impacted location
Sources
We reported that Circleville restored municipal systems after ransomware activity and did not pay a ransom. Our reporting found no published county minutes or meeting recording independently corroborating the Facebook account, no public ransomware or extortion-group claim for the current incident, and no city response by publication to questions about detection, Police Department technology scope, notification timing or the restoration date.
TVAO reported that Pickaway County EMA Director Tiffany Nash told county commissioners that Ohio Homeland Security and the Ohio Cyber Integration Center alerted her to a potential ransomware incident and that the event affected the city and Police Department. The account said Nash learned the incident occurred Aug. 14, a date that conflicts with the contemporaneous Aug. 6 city alert. It did not identify affected police systems or establish operational interruption.
Mayor Michelle L. Blanton said portions of the city’s technology environment were affected by ransomware activity. The city did not pay a ransom; operations were restored; affected systems were rebuilt from clean environments or recovered through established procedures and reviewed before return to service. The city was not aware of evidence establishing that sensitive information was exfiltrated, while the investigation and post-incident review remained ongoing.
Scioto Post published a City of Circleville statement confirming that the incident involved ransomware activity and that the city did not pay a ransom. The statement said operations were restored, affected systems were rebuilt from clean environments or recovered through established procedures, and the city was not aware of evidence establishing that sensitive information was exfiltrated.
See something that needs correction?
Signed-in members can report an error, update, or missing source.