City of La Vergne Network Compromise

Analyst assessment

DysruptionHub assesses with high confidence that the City of La Vergne experienced a cyber incident that disrupted municipal computer systems in October 2025. The city reported on Oct. 17 that it had taken affected systems offline, engaged cybersecurity specialists and law enforcement, and kept public safety and water services operating. Its Oct. 20 update described a compromise of the city network and said unusual activity had been detected on the morning of Oct. 17. That is the first established detection date, not proof of when unauthorized activity began.

The DragonForce listing names the city as a claimed victim. Comparitech reported that the group alleged it had stolen 382 gigabytes of data and threatened release. The city has not publicly verified the group’s responsibility, the claimed quantity or the use of ransomware. The listing supports an extortion claim, not confirmed encryption or attribution.

Operational significance

The city said its offices closed to the public and employees were sent home early while the network was offline. Managers used manual processes to keep work going, according to the Oct. 20 city update. By Oct. 29, City Hall and City Court were preparing to resume regular hours with limited functions, the public library remained closed, and city meetings could not be livestreamed.

The library reopened with limited services on Nov. 13, but books could not be checked out and public computers were unavailable. This shows that disruption to a resident-facing service lasted at least into mid-November. The city’s initial statement said essential public safety and water services remained operational; the reviewed sources do not establish interruption of emergency response or water delivery.

Disclosure posture

The city’s early public notices described the network disruption and service limitations. In June 2026, the city confirmed that it had sent legitimate notification letters to people who might have been affected by the October incident. A Massachusetts breach report lists 14 residents affected and Social Security numbers breached; a Vermont attorney general listing also identifies Social Security numbers for one resident. Those records substantiate a personal-information impact for notified people, but do not establish how the information was obtained, whether it was exfiltrated, or whether DragonForce possessed it.

Retrospective note

The last reviewed city notice showing an operational limitation was the Nov. 13 library update. Because that notice is nearly a year old and no final restoration statement was found, DysruptionHub assesses that the operational disruption is presumed resolved while the precise recovery date remains unknown. The 2026 notification process is a later consequence of the incident, not evidence that city systems remained disrupted then.

Confidence and uncertainty

Confidence is high that a cyber-related network compromise occurred and affected city services because the city directly documented both. Confidence is high that notification involved Social Security numbers for at least some recipients because state breach records identify that data category. Confidence is low in DragonForce attribution and its claimed data volume: the group made the allegation, but independent public verification was not found. Ransomware encryption remains unestablished.

Analytic gaps

The reviewed record does not establish initial access, the specific attack mechanism, malware, the full set of affected systems, when unauthorized activity began, the total number of people affected, the scope of any data transfer, the ransom demand or payment status, or the date all municipal and library functions were restored.