Everett closed City Hall Sept. 8-17 after a cybersecurity incident affected municipal systems, shifting basic services to the Connolly Center while public safety and several other services continued. City Hall reopened Sept. 21 with regular municipal services; Everett said the incident was contained and a very small amount of city data was affected, while review of possible personal-information involvement continued.
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
DysruptionHub assesses with high confidence that the City of Everett, Massachusetts, experienced a confirmed cybersecurity incident affecting its internal network and technology systems. In a Sept. 7 notice, the city said it discovered the incident at approximately 6:30 p.m. Sept. 6 and began working with its IT team and cybersecurity professionals to investigate and safely restore affected systems.
The city’s cyber-specific characterization confirms cyber involvement but does not establish ransomware, malicious access, malware, data theft, extortion or attribution.
Everett closed City Hall to the public Sept. 8 and extended the closure through Sept. 10. Basic municipal services moved to the Connolly Center, including the treasurer and collector, assessor, city clerk, engineering, auditing, procurement, inspectional services, housing assistance and parking. The alternate location reduced the disruption but did not restore normal City Hall access.
The city said Everett Police, Everett Fire, the Department of Public Works, Everett Public Schools and Everett Public Libraries continued operating normally. These statements limit the documented scope and do not establish disruption to emergency services, schools, libraries or public works.
Everett City Hall reopened Sept. 21 with regular municipal services after remaining closed through Sept. 17. The city said it had contained the incident before it spread further, that a very small amount of city data was affected and that investigators were still determining whether personal information was involved. In a Sept. 22 update, the city confirmed normal operations and regular municipal services had been restored. The positive restoration notices support resolved operational status; the continuing investigation does not by itself keep the incident active.
The city said technology modernization had begun before the incident. Local reporting of the city’s update said it was replacing aging hardware and infrastructure after the incident. That work does not establish the cause of the incident or a continuing service outage.
Confidence is high that a cyber-related disruption occurred because the affected city directly characterized the event as a cybersecurity incident and linked it to affected internal systems and the City Hall closure. The available record does not establish the technical cause, whether an intruder accessed the network, the nature and scope of the acknowledged data impact, whether personal information was involved or whether the incident involved ransomware.
A Ransomware.live allegation preserved in linked claim evidence, discovered Oct. 20, names Everett City Hall and attributes a claim of 15 GB of stolen data to Booba Project. The underlying actor post, advertised volume and connection to the September incident have not been independently authenticated. The index supplies an Oct. 20 claimed attack date, which is not verified and does not replace the city’s Sept. 6 detection date. The allegation does not establish renewed service disruption, ransomware execution or confirmed data theft. Everett’s documented Sept. 21 restoration remains the basis for resolved operational status.
The public record does not establish the initial access vector, compromised account or host, exploited vulnerability, malware family, dwell time, persistence, affected applications, data access or exfiltration, encryption, ransom demand, payment, threat actor, service-specific technical restoration details or forensic conclusion.
Preserved index assertion via Cyberwatch: Booba Project alleges 15 GB of stolen city data. Original actor post and index entry were not independently accessible in this pass; no original post URL or screenshot supplied. Claimed attack date Oct20 is unverified and does not replace official Sept6 detection. Connection to the September incident, attribution and exfiltration remain unconfirmed. Does not establish a new October outage.
We reported that Everett closed City Hall after a cybersecurity incident affected municipal systems while emergency services, schools, libraries and third-party online payments remained operational.
Everett said a cybersecurity incident discovered at about 6:30 p.m. September 6 affected internal network and technology systems, prompting a September 8 City Hall closure while public safety and several other services continued normally.
Boston.com reported Everett’s announcement that City Hall would close September 8 after a cybersecurity incident affected municipal internal networks and technology systems.
Everett said City Hall would reopen Sept. 21 with regular municipal services, the incident had been contained before spreading further, a very small amount of city data was affected and investigators were reviewing whether personal information was involved.
Boston 25 reported Sept. 19 that Everett City Hall was scheduled to reopen Sept. 21 after the cybersecurity incident.
Everett confirmed normal operations were restored and City Hall reopened Sept. 21. A very small amount of city data was affected; review of possible personal-information involvement and cybersecurity work continued.
Local reporting of the city’s recovery update said Everett was replacing aging hardware and infrastructure following the incident; modernization had begun before it. Regular municipal services resumed Sept. 21.
Signed-in members can report an error, update, or missing source.
