Skip to content

Coppell cyberattack disrupts municipal services

Summary

City of Coppell logo

An October 2024 cyberattack disrupted Coppell’s phones, payment channels, permitting, court and library functions. Recovery took weeks, followed by notices about potentially exposed personal information.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Critical infrastructure sector

Incident characteristics

Assessments

Attack mechanisms

Data impacts

  • Data exposure

    Data was made accessible to unauthorized parties through misconfiguration, system compromise, improper access controls, or another unintended condition.

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Internet access disruption

    The organization lost or materially restricted internet connectivity.

  • Phone service disruption

    Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.

  • Online portal unavailable

    A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Application unavailable

    A specific application or software platform became unavailable or unusable.

  • Payment processing disruption

    The organization could not process, receive, issue, reconcile, or record payments normally.

  • Transaction processing disruption

    Business, financial, customer, administrative, or operational transactions could not be completed normally.

  • Records access disruption

    Staff, customers, patients, students, residents, or other users could not access records or case information normally.

  • Records processing disruption

    The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.

  • Scheduling disruption

    Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.

  • Government services disrupted

    Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.

  • Utility operations disrupted

    Electric, water, wastewater, gas, telecommunications, or other utility operations were materially affected.

  • Facility closure

    One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Backlog created

    The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

  • Customer or public access restricted

    Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

Incident narrative

Analyst assessment

DysruptionHub assesses with high confidence that a cyberattack disrupted Coppell, Texas, on Oct. 23, 2024. The city’s catastrophe filing identifies a cyberattack and loss of access to municipal records. Its later investigation confirmed unauthorized network access that day. Ransomware and RansomHub attribution remain unverified beyond external claims.

The city announced phone and system outages Oct. 23. Its cyberattack filing was publicly documented by our Oct. 28 reporting. This was the city’s account hosted by the Texas attorney general, rather than an independent forensic finding by that office.

Operational significance

Archived city updates document disruption to phones, internet access, permitting, inspections, utility payments, court functions, library services and public-records processing. Some third-party services remained available. The city said 911 and early voting were unaffected.

Recovery occurred in stages. Phones returned Nov. 1, followed by utility payment channels Nov. 14. Billing delays and outstanding account work continued, with November late fees and water cutoffs waived. Normal library hours were planned for Nov. 15, while internet, Wi-Fi and printing remained unavailable in the Nov. 14 update.

A Nov. 15 notice announced a Nov. 18–19 closure of the inspections counter to update files and reopen its portal; previously scheduled inspections would continue. The Record later reported several operations reopened by Nov. 20. These milestones did not establish a citywide technical all-clear.

Confidence and uncertainty

In Dec. 15 reporting, the Coppell Chronicle quoted technology director Josh Littrell saying all affected systems and data had been restored at the Dec. 10 council meeting. This supports resolved operational status with high confidence, while the precise final restoration date remains unknown.

The city’s later data notice identifies potentially exposed Social Security and driver’s license numbers, financial and credit card information, and medical or insurance information. Categories varied by person. The city identified sensitive information during its March 26, 2025, review and mailed notices June 19. These are investigation and notification milestones for the October incident.

Analytic gaps

RansomHub claimed the city on Nov. 25, according to The Record. Comparitech reported an alleged 442GB theft and 16,835 people notified. The city has not independently confirmed the group or volume. Confidence in ransomware and actor attribution is low: original city notices do not establish encryption, a ransom demand or payment. Initial access and the exact restoration date remain unresolved.

Threat actor and claim

Listed as: coppelltx.govSource: ransomware.liveDiscovered:

Claim details

Ransomware.live indexes a RansomHub victim listing for coppelltx.gov, discovered Nov.25,2024 at17:00:52.248040UTC. Original actor-post URL and exact publication time are unavailable; tracker discovery is not the attack date. The Record’s Nov.26 original report says RansomHub took credit the previous Monday. Comparitech’s July4,2025 original report attributes an alleged442GB theft to the group and reports16,835people notified. Original city notices independently establish unauthorized network access Oct.23,2024 and potentially exposed personal information, but do not confirm RansomHub responsibility, the claimed volume, encryption, a ransom demand/payment or full data publication. Keep the allegation explicit with low actor/ransomware confidence. The existing shared RansomHub identity and primary CTI references remain unchanged.

Organizations involved

Impacted location

  • Coppell, Texas

    Coppell contains the city’s affected administrative offices, public facilities and municipal service counters. This city-site relationship complements the city service-area overlay without creating a facility location, identifying an intrusion origin or implying every physical facility closed.

    The incorporated City of Coppell is the affected municipal government’s physical service remit, spanning Dallas and Denton counties. Original city updates document specified permitting, court, records, payment and library effects, while911andearlyvotingcontinued. This geographic overlay does not assert all city services or residents were affected, or countywide disruption. Legacy role normalized; existing city target retained.

Sources

Coppell Catastrophe Notice

See something that needs correction?

Signed-in members can report an error, update, or missing source.