Claim details
INCRansom listed meridenct.gov; Meriden did not publicly confirm the claim.
Meriden Internet Shutdown and INCRansom Claim
Summary
Meriden, Connecticut, shut down city internet services and public Wi-Fi after an attempted disruption detected Feb. 17, 2026, limiting municipal and library services. INCRansom later listed meridenct.gov on its leak site in March, but the city did not publicly confirm ransomware or attribution.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
DD-CIT assessment
Only external sources publicly identify the event as cyber-related. The organization publicly documents the resulting service disruption.
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Event or activity cancellation
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Customer or public access restricted
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
Extortion indicators
-
Leak-site listing
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
Incident narrative
Analyst assessment
DysruptionHub assesses with high confidence that Meriden, Connecticut, experienced a municipal internet disruption and with medium confidence that it was cyber-related. DysruptionHub’s reporting compiled the city’s public account and the later actor claim. The city described an attempted disruption of internet service and took city internet and public Wi-Fi offline while police and information technology staff investigated. A later INCRansom claim reported March 26 provides concrete external cyber evidence but remains unconfirmed attribution.
Operational significance
The shutdown limited some nonessential city operations, eliminated public Wi-Fi and left the Meriden Public Library without internet-dependent computer access, scanning, faxing and printing. The City Council canceled its Feb. 17 meeting and rescheduled it for Feb. 19 as an in-person-only meeting because livestreaming was unavailable. Residents and businesses with appointments were advised to call departments before traveling, and the city said late tax or fee payments tied to the outage would not be penalized. Emergency services were not affected.
The affected municipality is Meriden in New Haven County, Connecticut. The county is retained only as the municipality’s administrative parent.
Confidence and uncertainty
Confidence is high that the internet disruption occurred and medium that it was cyber-related. The city’s phrase “attempted disruption” did not establish a cyberattack by itself, and officials initially said they had not determined the incident’s nature or scope. INCRansom’s later listing confirms the existence of an external cyber claim but does not prove encryption, data theft, a ransom demand or actor responsibility. The technical mechanism and data impact remain unknown.
Disclosure posture
Meriden documented the disruption and precautionary shutdown beginning Feb. 17 without cyber-specific attribution. The later INCRansom listing supplied the first located stable cyber claim, and no subsequent city cyber confirmation was located, supporting external-only cyber transparency and organization-documented disruption.
Current status
The incident is presumed resolved. Operational disruption was last documented Feb. 19, and no evidence of continuing service impact was located more than 30 days later. No affirmative final restoration notice was found.
Analytic gaps
The public record does not establish initial access, whether the attempted disruption succeeded, affected systems beyond connectivity services, encryption, exfiltration, exposed data, ransom communications, recovery cost or the city’s assessment of INCRansom’s claim.
Threat actor and claim
Organizations involved
City of Meriden
Location
Organization type
Critical infrastructure
Impacted location
Sources
DysruptionHub reported that Meriden took internet services and public Wi-Fi offline, canceled a council meeting and limited library and municipal services while police investigated.
WFSB reported the precautionary city internet and public Wi-Fi shutdown, police investigation, library service limitations and the city’s waiver of penalties tied to the outage.
The report preserved an INCRansom leak-site claim posted March 26 identifying meridenct.gov. The claim was not confirmed by city officials.
See something that needs correction?
Signed-in members can report an error, update, or missing source.