Cleveland ransomware attack disrupts City Hall services

Analyst assessment

A ransomware attack led Cleveland to shut down affected systems and close City Hall and offices at Erieview Plaza to the public in June 2024. The city initially announced a cyber incident June 9, with closures beginning June 10. Its June 14 statement, reproduced by News 5, confirmed ransomware after an investigation involving city IT staff, the FBI and Ohio Cyber Reserve resources.

Officials said abnormalities were first detected Saturday, June 8. That is a detection milestone, not a verified initial intrusion time. The city’s earlier cyber acknowledgment is distinct from its later ransomware confirmation. Our June 14 report covered the ransomware disclosure; it was not the first public notice of the underlying incident.

Operational significance

The interruption blocked normal public business at City Hall, including processing building permits and birth and death certificates. An attempted June 12 reopening encountered technical problems, and the city again restricted public access. Its June 12 public update said services would remain unavailable to residents June 13–14 while employees could enter.

Residents seeking vital records were directed to online options or neighboring municipal offices. The city’s June 18 reopening notice announced selected services for noon June 20, including Building & Housing, Assessments/Licenses and Vital Statistics. It warned of lines and delays and instructed building customers to upload documents because staff could not scan paper submissions. The Juneteenth holiday closure was separately scheduled.

The city said public safety, airport operations, utilities, waste collection and recreation centers continued operating. Its June 10 update also said municipal courts were operating on a different system. In a separate data statement, the city said CCA taxpayer information and public-utility customer information were unaffected while the broader investigation continued. These are limited city assurances, rather than findings about every municipal record. The City Hall closure does not establish a shutdown of all municipal services.

In the subsequent-events note to its 2023 annual financial report, the city said malware infected certain systems June 8 and officials disconnected systems from the internet to contain it. The city reported employee timekeeping, payroll, financial and email systems as unaffected, along with systems serving public utilities, port control and taxation. These are the city’s reported findings, rather than a comprehensive forensic determination about every municipal system or record.

June 20 reporting confirmed the reopening with minimal disruptions. A spokesperson said all business-critical systems were available while restoration of other systems continued. This was a substantial service recovery, rather than an all-systems restoration date. The incident is assessed as presumed resolved, with no exact operational end date.

Confidence and uncertainty

Confidence is high in ransomware involvement and the municipal service interruption because the city explicitly acknowledged both. In a June 10 official post, it also confirmed affected-system shutdowns and the City Hall and Erieview closures.

The city said it would not negotiate with the attackers or respond to their requests. That establishes a publicly stated refusal, not a complete payment history. The amount and terms of the demand were not disclosed.

July 26 reporting quoted responder Chris Prewitt describing a Russian-affiliated ransomware group without naming it. That attributed assessment does not identify a specific operator. The report described continuing investigation and anticipated follow-up work, not a newly documented service outage. This occurrence is separate from the February 2025 Cleveland Municipal Court attack and its later Qilin claim.

Analytic gaps

The initial access method, exact intrusion window, systems encrypted, scope of any copied information, affected-person count, ransom amount and final restoration date remain unresolved. Containment and reopening statements do not establish that no information was accessed or removed. A precise recovery accounting is also needed to quantify delayed permits, records requests and remaining work after June 20.