City of Hawkins
City of Hawkins suspected cyber incident
Summary
Hawkins, Texas, shut down city computers after disputed access in April 2024, interrupting water billing and online payments. Billing capabilities resumed by April 24; the Texas Rangers later closed the investigation after finding no offense.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Hawkins, Texas, stopped using city computers after disputed access to a City Hall machine April 1, 2024. Mayor Debbie Rushing alleged suspicious activity, while the mayor pro tem said the access was part of a contracted security assessment. April reporting documented the disagreement and a state investigation.
The investigation’s reported outcome did not substantiate a criminal offense. In December, Texas Department of Public Safety Sgt. Adam Albritton told KLTV that the Texas Rangers had cleared the person previously suspected and closed the case. The earlier allegations do not establish a proven malicious intrusion.
Operational significance
The shutdown interrupted water billing and online payments. Residents could use cash, checks or money orders while city staff lacked normal computer access. This was an administrative and payment interruption; the reporting does not establish disruption of drinking-water delivery.
The April 15 council minutes recorded staff using paper records and the mayor’s account that the Texas Municipal League had advised shutting down computers. Participants disputed whether the assessment or the shutdown response caused the difficulties.
By April 24, Rushing said the city could process water payments and issue new bills again. Staff were still reading meters and preparing billing statements. The amount of any lost revenue remained uncertain.
Confidence and uncertainty
Confidence in the documented service interruption is high. The authority for the original access was publicly disputed, and the state investigation subsequently found no offense. Remote-access or network-mapping software alone does not establish criminal intent, ransomware or data theft.
The investigative closure is distinct from operational restoration. The April recovery report establishes resumed billing capabilities with catch-up work continuing, but does not provide a complete restoration date for every city system.
Analytic gaps
The public record does not include a detailed technical account of the software’s effects, the full extent of any access to information or the final date all administrative functions returned to normal. The case could be reopened if additional evidence emerged, according to the December report; that conditional statement does not establish continuing malicious activity.
Organizations involved
Impacted location
Hawkins, Texas
Hawkins is the municipal government’s service area. Documented effects concerned computer use, water billing and payments; drinking-water delivery interruption was not established.
City Hall in Hawkins was the setting for the disputed computer access and ensuing administrative shutdown.
Sources
The mayor alleged improper installation of remote-access and network-mapping software and said City Hall computers, utility payments and city secretary operations were offline.
City officials disputed whether computer access was authorized while billing and online payments were interrupted and state investigators examined the incident.
The mayor said billing and payment processing had resumed while staff completed meter reading and statements.
DPS said investigators found no offense and closed the case, clearing the person previously suspected.
The minutes record computer shutdowns, payment workarounds, paper records and conflicting accounts of the security assessment.
See something that needs correction?
Signed-in members can report an error, update, or missing source.