A June 1, 2025, ransomware attack disrupted Durant’s payments, administrative systems and police communications network while 911 remained operational. The city later warned of possible access to personal information; INC Ransom’s theft claim remains unverified.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Internal or external network connectivity was unavailable or materially impaired.
A public-facing website was unavailable, disabled, or inaccessible.
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
The organization could not process, receive, issue, reconcile, or record payments normally.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Services continued but with longer processing, response, delivery, or completion times.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.
The actor explicitly threatened to publish or publicly release victim data or incident details.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.
The City of Durant experienced a ransomware attack June 1, 2025, that disrupted municipal computer networks, digital payments and administrative systems. The police department’s June 1 notice documented outages on city-owned servers, and the city’s June 2 statement explicitly identified ransomware. Our initial reporting described the resulting payment and billing disruption.
The city later warned that an attacker may have accessed a server and database containing information about people who had interacted with the municipality. Its July 15 information security notice identified names, addresses, Social Security numbers and financial information as potentially involved. The city did not believe the attacker had access to all internal files and systems and reported no known actual misuse at that time. These findings are narrower than confirmation that every resident’s records were stolen.
The outage impaired the city’s ability to accept digital and credit card payments and use some administrative programs. KXII’s June 2 report described cash and check payments at City Hall and a telephone option for people with an account number. Those alternatives allowed some transactions to continue while ordinary payment channels were unavailable.
The police communications center also experienced network effects, but the department said emergency services remained operational and residents could continue calling 911. It warned that non-emergency callers might face longer waits because of the outage and call volume. The Record reported June 3 that the city’s website was still down. These observations establish municipal service disruption without establishing loss of 911 service or a countywide outage.
In a June 6 update, the city projected that online payments would return Monday, June 9. The post described a planned return rather than confirming that it happened. The July 15 notice said the city believed the incident was contained after isolation, remediation and work with outside forensic and IT specialists. Containment and the absence of a later verified operational outage support a presumed resolved assessment; the exact date of complete service restoration remains unverified.
Confidence is high that ransomware caused the municipal disruption because the city acknowledged both. The early June statement that officials knew of no personal information compromise was provisional. The later notice established possible access to information on an affected server, while leaving the precise data impact and investigation outcome unresolved. The continuing investigation does not by itself establish continuing service disruption.
INC Ransom claimed responsibility, alleging theft of more than 800 GB and threatening disclosure. Comparitech reported the claim June 17, including a 48-hour payment deadline. The city has not verified the group’s responsibility, stolen volume or claimed information categories. The tracker’s discovery timestamp is not the intrusion date or a verified original publication date. Nearby attacks and references to RansomHub in reporting about other governments do not establish a common attacker or campaign for Durant.
The initial access method, intrusion onset before June 1 detection, exact extent of unauthorized data access, any verified exfiltration and the final investigation findings remain unknown. The reviewed evidence does not establish whether a ransom was paid, whether the threatened data was released or when every affected municipal capability returned to normal. The June 9 payment milestone remains a projection in the original city source, so no exact operational end date is assigned.
INC Ransom claims the city as a victim, alleges more than 800 GB of stolen data and threatens publication after a 48-hour deadline. The listing’s description identifies the city address and durant.org. The city has not confirmed INC Ransom’s responsibility, the claimed volume or the final disclosure outcome. Tracker discovery is not an intrusion or verified original publication date.
Municipal government remit for the affected city services. Payment and administrative functions were disrupted; emergency 911 service remained operational.
Durant contains City Hall, where residents were directed to use alternative payment methods during the outage.
The June 1 ransomware incident disrupted municipal billing, digital payments and administrative services.
Network outages on city-owned servers affected the police communications center. Emergency services and 911 remained operational.
The city says it became the target of ransomware June 1 and that digital and credit card payments remain affected.
City officials confirmed ransomware affecting digital and credit card payments and administrative programs, with alternative payment methods available.
The report documents Durant’s website outage and police communications network disruption while 911 continued operating.
The city projected that online payment systems would return Monday, June 9.
The city’s notice says an attacker may have accessed a server and database containing personal and financial information. The city believed the incident was contained.
The report describes the city’s July notice about possible access to personal information after the June incident.
INC Ransom claimed 800 GB of stolen city data and issued a 48-hour deadline. The city had not verified the claim.
The tracker records an INC Ransom listing that identifies Durant’s city address and website and threatens publication of purportedly stolen data.
Signed-in members can report an error, update, or missing source.
