Skip to content
DysruptionHub
Sign in Subscribe

City of Hoboken ransomware incident

Summary

City of Hoboken logo

Hoboken closed City Hall and suspended online services after a Nov. 27, 2024, ransomware attack. Services returned in stages, and the city later confirmed unauthorized access to files containing personal information.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
Confirmed
Attribution:
Low

Attack mechanisms

  • Ransomware

    Malware that encrypts systems or data, typically accompanied by a ransom demand.

  • Unauthorized access

    Unauthorized access to systems, accounts, networks, or data.

Data impacts

  • Unauthorized data access

    An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.

Operational impacts

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Email disruption

    Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.

  • Online portal unavailable

    A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Payment processing disruption

    The organization could not process, receive, issue, reconcile, or record payments normally.

  • Government services disrupted

    Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.

  • Facility closure

    One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.

  • Event or activity cancellation

    Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

  • Alternate service channel required

    The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

Incident narrative

City Hall and municipal services disrupted

Hoboken, New Jersey, identified a ransomware attack early Nov. 27, 2024. Its initial public alert closed City Hall, suspended online city services, canceled that day’s municipal court session and halted street sweeping. Waste collection and recreation programs continued.

Police, city IT staff and outside specialists investigated and worked to restore services.

Services returned in stages

A Dec. 1 city update said most resident services were available online through third-party vendors. The parking utility planned to reopen its service window Dec. 2 with cash or check payments. Email and Wi-Fi restoration continued, and residents were directed to call city departments.

By Dec. 4, parking-window card payments and most staff email access had returned. Responses could be delayed, and Vital Statistics and Licensing remained reachable only by phone. That update did not establish full restoration of every system.

Later investigation identified personal information

In its May 23, 2025, notice, Hoboken said certain files were accessed without authorization between Nov. 26 and 27, 2024. The affected information varied by person and could include names with Social Security numbers, driver’s-license or state-identification numbers, or bank-account and routing numbers.

The city completed its file review March 12 and address research May 16. It said it had no reason to believe information had been misused at the time of the notice. A call center and complimentary monitoring and identity protection were offered.

Those review and notification milestones are distinct from operational recovery. The notice does not provide a final affected-person count.

Attribution remains qualified

The Record reported Dec. 5 that ThreeAM claimed responsibility and listed the city on its leak site. That is an attacker claim, not city-confirmed attribution. The reviewed city notices do not establish a ransom payment or independently confirm the claim’s data-theft assertions.

Current assessment

The incident is presumed resolved because the last directly verified operational limitations were documented Dec. 4, 2024. The reviewed sources do not establish an exact date when all affected systems were restored. Later investigation and notification dates do not extend the documented service disruption.

Threat actor and claim

ThreeAM

Listed as: hobokennj.govSource: ransomware.liveDiscovered:

Claim details

Ransomware.live lists the City of Hoboken’s official domain under ThreeAM, discovered Dec. 4, 2024. The Record’s original Dec. 5 report says the group claimed responsibility Wednesday, Dec. 4, without specifying what data was stolen or how much. The tracker discovery time is not a verified original post time or intrusion date. This is an attacker claim; Hoboken independently confirmed ransomware and unauthorized file access but did not confirm this actor, data exfiltration or a ransom payment. Preserve the existing ThreeAM entity and its separately sourced research.

Organizations involved

Impacted location

  • Hoboken, New Jersey

    City Hall is at 94 Washington St., Hoboken, NJ 07030, as stated in the official city website footer and May 23 incident notice. Exact Census street-address match places City Hall in incorporated Hoboken3432250, Hudson County34017. The initial city alert explicitly closed City Hall. This is the administrative physical-site city, not an individually mapped building.

    City of Hoboken is the municipal government for Hoboken, Hudson County, New Jersey. The city website’s departments/council pages and official ransomware notice establish the governmental authority and affected municipal operations. Reuse the existing city as its service area; the relationship identifies the affected authority’s remit, not an outage affecting every resident or all functions. Waste collection and recreation continued in the initial notice.

    Source

Sources

Ransomware Attack Shuts Down Hoboken City Hall and Online Services
DysruptionHubPublished: Retrieved:
  • Type: News Report
  • Stance: Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: Medium

DysruptionHub reported Hoboken’s City Hall closure and suspension of online services, municipal court and street sweeping after the city’s ransomware alert.

Hoboken City Hall closed following ransomware attack
City of HobokenPublished: Retrieved:
  • Type: Official Statement
  • Stance: Confirm
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

The city identified a ransomware attack, closed City Hall and suspended online services. Municipal court and street sweeping were canceled; waste collection and recreation programs continued.

Hoboken ransomware recovery update, Dec. 1
City of HobokenPublished: Retrieved:
  • Type: Operational Update
  • Stance: Confirm
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

Most third-party online resident services were available. The city planned to reopen its parking utility window Dec. 2 for cash or check payments while email and Wi-Fi restoration continued.

Hoboken ransomware recovery update, Dec. 4
City of HobokenPublished: Retrieved:
  • Type: Operational Update
  • Stance: Confirm
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

The parking utility window had resumed accepting credit cards and most city staff could be reached by email, with delays. Vital Statistics and Licensing were still reachable only by phone.

City of Hoboken opens call center regarding ransomware incident
City of HobokenPublished: Retrieved:
  • Type: Official Statement
  • Stance: Confirm
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

The city announced a dedicated call center with credit monitoring and identity protection, while specialists and federal authorities investigated the ransomware incident.

Notice of Data Incident
City of HobokenPublished: Retrieved:
  • Type: Official Statement
  • Stance: Confirm
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

The city confirmed unauthorized access to files between Nov. 26 and 27, 2024. The information varied by person and could include names, Social Security numbers, identification numbers and banking details.

Ransomware.live listing for hobokennj.gov attributed to ThreeAM
Ransomware.liveRetrieved:
  • Type: Research Threat Intelligence
  • Stance: Claim
  • Platform: Website
  • Medium: Web Page
  • Confidence: Low

A tracker lead lists hobokennj.gov under ThreeAM and describes the victim as the City of Hoboken. It records discovery on Dec. 4, 2024.

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.