Meriden’s municipal network shutdown disrupted payments, records, meetings and library services. Later city breach notices identified ransomware and possible exposure affecting 2,325 Connecticut residents; INC Ransom attribution remains unconfirmed.
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Unauthorized access to systems, accounts, networks, or data.
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
The organization lost or materially restricted internet connectivity.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
The organization could not process, receive, issue, reconcile, or record payments normally.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
DysruptionHub assesses with high confidence that Meriden, Connecticut, experienced a ransomware-related municipal network disruption. Our initial report documented a precautionary shutdown and qualified city cybersecurity language. Later reporting on city breach notices establishes unauthorized network access rather than only an unsuccessful interruption attempt.
CT Examiner reported Sept. 17 that Meriden identified the attack as ransomware in a June filing with Connecticut’s attorney general. The city reported possible exposure affecting 2,325 Connecticut residents. The reported intrusion window was Feb. 9–March 13, with discovery Feb. 12; the city identified potential personal-data exposure in May and sent notifications in June. Those dates describe intrusion and notification, not the duration of service disruption.
Meriden shut down its network Feb. 13. Internet loss affected city departments, manual recordkeeping, payments, public Wi-Fi and library computer, scanning, fax and printing services. The City Council canceled its Feb. 17 meeting; later meetings initially lacked livestreaming.
Emergency dispatch relocated to the Connecticut Statewide Emergency Communications Center while emergency response continued. Some email and web publishing returned in early March. By April 23, online payments, hybrid meetings and local dispatch had returned, but officials could not identify what other services remained affected. The city’s subsequent online permitting announcement describes a new offering, not an incident-wide all-clear. Geographic overlays represent the city’s municipal remit, not an area-wide outage or loss of every public-safety function.
Hearst Connecticut Media reported June 24 that a city letter acknowledged unauthorized access and possible exposure of names, Social Security and driver’s license numbers, bank accounts and routing numbers, with no identified misuse of that recipient’s information. It described an FBI investigation and two years of monitoring. Reporting on the notices also describes forensic assistance, rebuilding affected systems and security-policy reviews. These findings support unauthorized access and possible exposure, not confirmed exfiltration, publication or encryption.
INC Ransom listed meridenct.gov March 26. Ransomware confidence is now high because reporting conveys the city’s own characterization; actor confidence remains medium. Neither the city notices nor newly reviewed coverage corroborates INC Ransom responsibility. The group’s listing does not independently prove encryption or theft.
The city’s Feb. 17 statement referred to cybersecurity concerns and breach review before the March 26 actor claim. Organization-confirmed cyber and disruption transparency, OC–OD, remains appropriate. Later notices provide more specific acknowledgment without changing the earliest located disclosure date.
April 23 remains the latest supported operational-impact date. Without a complete all-clear or newer documented disruption, the incident remains presumed resolved, with no established end date. Initial access, affected hosts, confirmed data theft or encryption, ransom demands or payment, recovery costs and full restoration timing remain unresolved. The attorney-general filing was not directly inspected; its details are attributed to reporting rather than presented as our independent examination.
INC Ransom listed meridenct.gov March 26, 2026. Later reporting on city notices acknowledges unauthorized network access and identifies ransomware, but does not attribute the event to INC Ransom or independently confirm encryption, exfiltration or publication.
Citywide municipal service remit; this overlay does not assert an area-wide outage or disruption of every service. Preserve the supported Meriden municipality anchor.
We reported that Meriden took internet services and public Wi-Fi offline, canceled a council meeting and limited library and municipal services while police investigated.
WFSB reported the precautionary city internet and public Wi-Fi shutdown, police investigation, library service limitations and the city’s waiver of penalties tied to the outage.
The report preserved an INCRansom leak-site claim posted March 26 identifying meridenct.gov. The claim was not confirmed by city officials.
Hearst Connecticut Media reported that online payments, hybrid meetings and local emergency dispatch had returned by April 23 after a shutdown beginning Feb. 13, while officials could not identify what other services remained affected.
City announces online permitting and licensing for multiple departments.
Reporting quotes a city letter acknowledging unauthorized network access and possible personal-data exposure.
Reporting on city breach notices identifies ransomware and possible exposure affecting 2,325 Connecticut residents for Meriden.
Signed-in members can report an error, update, or missing source.
