Green River, Wyoming confirmed ransomware in June 2025. City payments, police reporting and council technology were affected; partial recovery followed. Qilin attribution and final restoration remain unresolved.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Internal business, administrative, operational, or staff-facing systems were unavailable.
The organization could not process, receive, issue, reconcile, or record payments normally.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
The City of Green River, Wyoming, experienced a ransomware attack that disabled municipal computer systems. Finance Director Chris Meats confirmed the attack in SweetwaterNOW’s June 25 report. Our reporting documented the interruption and the initial cash-only response at public facilities.
City staff lost normal access to systems used for administration and payments. Police continued filing reports using isolated equipment supplied by the combined communications board. The evidence establishes a workaround for police reporting rather than a shutdown of emergency dispatch or all law-enforcement activity.
At the July 1 council meeting, sound and video functions were unavailable and the regular public livestream did not occur. Residents also reported difficulty making online utility payments. Those billing problems do not establish interruption of water treatment or delivery.
Recovery was partial and uneven. By July 25, recreation card payments had resumed and the dispatch center was preparing to retrieve its loaned police equipment. A planned equipment return is not a verified full-restoration date. The September follow-up noted resumed council streaming and continuing city recovery work, while leaving the overall completion date undisclosed.
Confidence is high in the incident and ransomware assessment because the city finance director explicitly confirmed both cyber involvement and disabled systems. His initial statement that no data access or exfiltration had been identified describes the information available then; it does not establish a final forensic finding.
The existing Qilin association remains uncertain. Comparitech’s government-incident roundup attributed a Green River, Wyoming claim to Qilin, but the same-name ransomware.live lead identifies a Utah municipal website. The reviewed evidence does not resolve whether the external listing was mislabeled or concerned a different city. It therefore does not confirm responsibility or theft from the Wyoming government.
The exact intrusion date, affected data, payment or demand, recovery costs and full restoration date remain unverified. Detailed encryption findings have not been reviewed. Neighboring agencies reported no related disruption in the initial coverage, and they are not treated as compromised simply because they assisted or were contacted.
Operational disruption is presumed resolved based on the elapsed time and documented recovery milestones. No end date is assigned. The July 25 police workaround is the latest concrete continuing operational effect identified; a later investigation or general progress statement does not by itself establish continuing service loss.
Unresolved attribution: Comparitech refers to Green River, Wyoming as a data breach claimed by Qilin, while the same-name ransomware.live entry identifies www.greenriverutah.com and describes Utah. The reviewed evidence does not resolve that identity conflict or confirm Qilin responsibility, theft or a demand against the Wyoming city. Original listing publication is unverified; the Utah lead’s discovery timestamp is not assigned to this incident.
Green River is the base of affected city offices, recreation payment services, police reporting and council technology.
Municipal remit of the affected city government. Specific administrative and payment services were disrupted; citywide physical utility failure is not established.
Our report describes disabled city systems, cash-only payments and an isolated police-reporting workaround.
Finance director confirms ransomware and computer disruption; the report documents cash-only recreation payments and temporary police equipment.
The July1 council meeting lacked sound-system and streaming functions; residents also reported online utility-payment difficulty.
Report describes resumed recreation card payments and plans to retrieve equipment loaned to police.
A government-incident roundup says Green River, Wyoming had a data breach claimed by Qilin.
Finance director describes progress and continuing investigation; report notes council streaming had resumed.
Signed-in members can report an error, update, or missing source.
