An August 2024 ransomware attack disrupted Killeen’s municipal network, utility customer services and other city systems. Killeen identified BlackSuit and restored affected public services by Aug. 13 without paying a ransom.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Unauthorized access to systems, accounts, networks, or data.
Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.
Internal or external network connectivity was unavailable or materially impaired.
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
The organization could not process, receive, issue, reconcile, or record payments normally.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Services continued but with longer processing, response, delivery, or completion times.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
An authoritative source stated that no ransom or extortion payment was made.
A ransomware attack disrupted Killeen, Texas, municipal systems Aug. 7, 2024. The city publicly identified BlackSuit the following day, when utility customer-service delays continued. The incident is resolved: its Oct. 1 review reported that affected in-person services had fully returned by Aug. 13.
The later review distinguished a network outage of about 36 hours from the longer restoration of affected services. It said attackers initially entered through a virtual private network account in July and began encrypting files Aug. 7. That earlier access period does not establish an earlier service outage.
Utility Collections temporarily lost its normal customer-service payment system. Residents could still pay online or in person with cash, checks or money orders, while new-service, transfer and restoration requests went through telephone channels. Staff used manual processes. These were administrative service restrictions; the reviewed evidence does not establish interruption of water delivery.
The city’s initial notice also described brief Municipal Court and Transfer Station disruption, with those services restored by the Aug. 8 announcement. Contemporary local reporting identified government email problems. The city disconnected its Bell County network links as a precaution; this does not establish that Bell County’s own systems were compromised.
Confidence in ransomware and the city’s BlackSuit attribution is high because Killeen explicitly named the operation and later confirmed file encryption. Its IT director said a third-party review found no compromised citizen personal information, no infections among nearly 1,200 desktop and laptop computers, and full server restoration. Those are the city’s reported findings, rather than an independently published forensic examination.
The city said no ransom was paid and described recovery from backups. It identified approximately $35,000 for forensic work and $2,000 for Transfer Station software repairs. Those figures describe particular response expenses, not a ransom payment or a complete accounting of losses.
The exact initial access date, how the VPN account was obtained, and the inventory of encrypted files remain unverified. July access does not prove phishing or credential theft. The official Aug. 8 social acknowledgment corroborates that day’s public cyber disclosure; references to earlier utility-service notices do not establish an earlier public identification of a cyberattack.
The city reported affected services fully restored by Aug. 13, without a completion time. Its Oct. 1 publication is a retrospective assessment, not evidence of continuing October disruption. No public actor listing, published stolen data or ransom amount was independently established in the reviewed evidence.
Killeen’s Aug. 8 statement attributes the intrusion to BlackSuit ransomware. Its Oct. 1 review confirms Aug. 7 file encryption and says no ransom was paid. This records the city’s attribution rather than an independently verified actor listing. Reports of a threatened data release remain unconfirmed; a public leak-site entry, published stolen data, a payment deadline and a ransom amount are not established.
County containing affected Killeen municipal headquarters. Geographic site anchor only. Bell County network isolation was precautionary and does not establish compromise of Bell County government.
Municipal jurisdiction of the affected city government. Disruption concerned city systems and public-service transactions; the evidence does not establish interruption of water delivery.
Killeen contains the municipal headquarters at 101 N. College St.
We reported Killeen’s BlackSuit attribution, utility-payment workarounds, brief court and Transfer Station disruption, and precautionary disconnection from Bell County’s network.
The city attributes the intrusion to BlackSuit and describes utility customer-service restrictions, continued online payments and telephone workarounds. It says brief court and Transfer Station disruption had ended, and Bell County network connections were cut as a precaution.
Reports the city’s confirmation of a Wednesday ransomware attack and disruption involving government email and Municipal Court services.
The city’s Aug. 8 post acknowledges the cybersecurity incident and links its initial public notice.
The city reports July VPN access, file encryption Aug. 7, a network outage of about 36 hours and full restoration of affected in-person services by Aug. 13. It says servers were restored, no citizen personal information was compromised and no ransom was paid.
Signed-in members can report an error, update, or missing source.
