City of Greenville
Greenville municipal ransomware and records disruption
Summary
Ransomware identified in August 2025 blocked Greenville municipal records and disrupted utility account access. The city later confirmed insurer payment of a ransom and restored systems, while billing schedules still required catch-up.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Backlog created
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
Extortion indicators
-
Ransom demand
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
-
Payment reported
A source reported that the victim, insurer, intermediary, or another party made a ransom or extortion payment.
Incident narrative
Analyst assessment
A ransomware incident identified Aug. 5, 2025 disrupted Greenville, Texas, municipal systems and access to police and other records. We reported the city’s catastrophe filing Aug. 25, after earlier public notices described service problems without identifying ransomware.
The city’s subsequent investigation traced criminal access to a third-party service provider. It ruled out phishing and employee error but did not publicly name the provider, attacker or exact technical weakness.
Operational significance
An Aug. 6 city alert warned of internet issues and delayed telephone responses while confirming that 911 remained fully operational.
The city attorney’s catastrophe notice reported that municipal staff could not access police or other records and could not fulfill approximately 20 pending public-information requests. The Aug. 25–31 suspension of statutory response deadlines was an administrative measure, not the full duration of the attack. The notice’s possible Aug. 26 restoration was a forecast.
GEUS customers lost online-payment and billing access when the city disabled access to the utility’s account database as a protective measure. The later findings said GEUS’s own network was not compromised. A billing interruption does not establish an electricity-delivery outage.
When online payments resumed in early September, staff still had to enter payments received through other channels and catch up delayed bills. By Oct. 3, the city said systems were restored, but its FAQ still described delayed billing schedules and projected normalization by the end of November.
Confidence and uncertainty
Confidence is high in ransomware and records-access disruption because the city reported both in its public filing. The investigation release and FAQ confirmed that the insurer paid a ransom. The amount and recipient were not disclosed.
The city reported no affected citizen or employee personal information and no stolen GEUS data. These are the city’s investigative findings. They do not negate the documented loss of access to municipal records. The separate cloud payment processor was unaffected even though customers could not use normal online account services.
Attribution remains unresolved. Same-name claims involving Greenville, North Carolina, or a South Carolina law firm are unrelated to this Texas municipality.
Analytic gaps
The named attacker and provider, specific access technique, exact period of records unavailability, ransom amount, response cost and completion date for billing catch-up remain unestablished. The reviewed evidence does not independently confirm the end-November billing forecast was achieved.
Operations are presumed resolved based on elapsed time since the Oct. 3, 2025 observation of residual billing delays. The city’s restoration and investigation-closure statements establish technical recovery, but the same release still identified a billing-schedule recovery task. A projected completion is insufficient to establish full operational recovery on a particular day.
Organizations involved
Impacted location
Greenville, Texas
The city jurisdiction supplies the governmental service context for records access, public-information processing and municipal account-service disruption. It does not represent GEUS’s exact utility territory or universal service interruption.
Greenville in Hunt County is the administrative site anchor for the affected municipal government. This does not assert a citywide electricity outage or interruption of 911.
Sources
Our original report used Greenville’s catastrophe filing to document ransomware-related loss of access to police and other records.
The city warned that internet issues could delay telephone responses and told callers reaching voicemail to call again. 911 remained fully operational.
The city attorney reported ransomware against city servers, inaccessible police and other records and approximately 20 unfulfilled public-information requests.
GEUS announced online payments had resumed, while staff manually entered payments received by phone, mail or in person during the outage and caught up delayed bills.
The city confirmed an Aug. 5 detection, access through a third-party provider, restored city systems and insurer payment of a ransom. Its FAQ still described delayed billing schedules.
See something that needs correction?
Signed-in members can report an error, update, or missing source.