City of Lancaster
City of Lancaster ransomware incident
Summary
The City of Lancaster, Ohio, took municipal computers offline after ransomware notifications on Aug. 6, 2026, warning of delays in card payments and other computer-based work. By Aug. 28, the city had restored about 90% of affected data and programs, but recovery remained incomplete and some material might not return for security reasons.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
DysruptionHub assesses with high confidence that the City of Lancaster, Ohio, experienced a ransomware attack affecting municipal computers, data and software. A contemporaneous Aug. 6 alert was posted by the same Reddit account in r/LancasterOH and r/Ohio under the explicit title “Lancaster hit with ransomware”. The matching posts support assigning the reproduced city alert to Lancaster with medium confidence.
Lancaster’s Aug. 28 Administrative Services Committee agenda independently identified a ransomware update as an official IT/Telecom business item. The corresponding official committee minutes record the city IT director’s report that recovery work was continuing and that about 90% of data and programs had been restored.
Operational significance
The reproduced Aug. 6 alert said the city took all personal computers offline after ransomware notifications appeared on one computer and then on additional computers as employees began work. It said Lancaster remained operational and that 911, water, wastewater and telephone systems were not directly affected, while warning of delays in credit-card processing and other computer-based activities.
By Aug. 28, municipal employees were still recovering data and programs. The minutes said some of the remaining 10% might not return because of security issues, leaving part of the city’s digital working environment unavailable at the latest documented update. The minutes also said GIS access was maintained because its cloud conversion preceded the attack, although items from servers that would not return still required uploading. This is GIS continuity evidence, not proof that all municipal applications were unaffected.
Current status
The incident is presumed resolved under the registry’s 30-day operational-status rule. Aug. 28 remains the latest documented disruption: the city said about 90% of affected data and programs had been recovered, with work continuing on the remainder. Research through Sept. 28 found no newer dated impact or complete restoration statement. This provisional lifecycle classification is not confirmation that every affected system or file was restored; no actual end date has been established.
Confidence and uncertainty
Confidence is high that the incident was ransomware because Lancaster placed a ransomware update on an official committee agenda and its minutes described ongoing recovery from the attack. Confidence is medium in the Aug. 6 chronology and initial service details because the surviving public evidence is a consistent third-party reproduction of the city alert rather than a stable city-hosted copy.
Threat-actor attribution and extortion details are unresolved. No reviewed source names a group, identifies a malware family, confirms a demand or payment, or independently connects Lancaster to a leak-site claim.
Analytic gaps
The public record does not establish the initial access vector, compromised account or device beyond the first reported computer, dwell time, encryption scope, affected network segments, restoration method, backup condition or total recovery cost. It also does not identify whether personal, financial, employee or resident information was accessed, copied or exposed.
Future city statements, breach notifications, forensic findings, insurance records or corroborated threat-actor material could clarify the operational scope, data impact and recovery outcome. Until then, the profile treats Aug. 6 as the earliest supported incident and disclosure date and Aug. 28 as the latest date of documented operational impact.
Revision note
This profile now includes an Aug. 6 Reddit alert that was previously attributed to the City of Circleville ransomware incident. The same account posted identical alert text in r/LancasterOH and in r/Ohio under the explicit title “Lancaster hit with ransomware,” supporting reassignment of the alert and its associated date and service-impact details to Lancaster.
Organizations involved
Impacted location
Sources
DysruptionHub reported that Lancaster took municipal computers offline Aug. 6 after ransomware notices appeared. City records said about 90% of data and programs had been recovered by Aug. 28, while recovery remained incomplete and some material might not return for security reasons.
A Reddit user reproduced an alert saying Lancaster received a ransomware notification on one PC early Aug. 6, followed by more notifications as employees accessed computers. The alert said all city PCs were taken offline, 911, water, wastewater and phones were not directly affected, and card payments and other computer-based work could be delayed.
The City of Lancaster’s Administrative Services Committee agenda for Aug. 28 listed a ransomware update under IT/Telecom department business.
The Aug. 28 Administrative Services Committee minutes say the city had recovered about 90% of affected data and programs after the ransomware incident. Employees continued working on the remaining 10%, and some data or programs might not be restored because of security concerns.
See something that needs correction?
Signed-in members can report an error, update, or missing source.