City of Leavenworth
Leavenworth municipal network cyberattack
Summary
A cyberattack disrupted Leavenworth, Kansas, municipal systems beginning Nov. 19, 2025. The city confirmed the cyber cause Nov. 25 and directed vendors, permit applicants and job seekers to use mail or in-person workarounds while it restored services.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Email disruption
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
DysruptionHub assesses with high confidence that the City of Leavenworth, Kansas, experienced a cyberattack that disrupted its internal network in November 2025. The city’s Nov. 25 update says its investigation determined that the network problems stemmed from a cyberattack. The city had first reported a network interruption Nov. 19.
Operational significance
The city said invoice processing, online permits and inspections, and emailed employment applications could require workarounds. It directed people to mail or deliver applications and permit requests to City Hall. Our reporting also documented limited phone and email access during the initial outage. The city said emergency operations were unaffected.
Current status
On Dec. 4, the city manager described the network as mostly functional, according to the Leavenworth Times account cited in our report. The public record reviewed here does not establish a full restoration date or a final technical all-clear. The incident is therefore presumed resolved as of this retrospective review; that classification does not assert that every system was restored by Dec. 4.
Disclosure posture
The city initially described a network outage and later identified a cyberattack on Nov. 25. Its statement said it was not then aware of compromised sensitive information but that the question remained under investigation.
Confidence and uncertainty
The city’s direct statement supports high confidence in cyber involvement and documented service disruption. No reviewed source identifies the attack mechanism, ransomware, a ransom demand, a threat actor or confirmed data access.
Analytic gaps
The initial access vector, affected systems, complete outage duration, final restoration, forensic findings and data-exposure outcome remain unresolved.
Organizations involved
Impacted location
Leavenworth, Kansas
City Hall place anchor; the city's internal network was affected.
Sources
We reported that the November cyberattack disrupted Leavenworth municipal services, limited phone and email access, and left some payment, permitting and hiring functions on manual workarounds in early December.
The city said its investigation determined the network problems stemmed from a cyberattack and warned that vendor invoices, online permits and inspections, and emailed job applications could require mail or in-person workarounds.
See something that needs correction?
Signed-in members can report an error, update, or missing source.