A cyberattack disrupted Middletown, Ohio municipal services and left utility billing impaired for months after its August 2025 discovery. The city confirmed data removal and restored billing in January 2026, while complete municipal recovery timing remains unestablished.
Unauthorized access to systems, accounts, networks, or data.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Internal or external network connectivity was unavailable or materially impaired.
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
The organization could not process, receive, issue, reconcile, or record payments normally.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Police, fire, emergency medical, corrections, emergency management, or other public-safety operations were materially affected.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
A cyberattack disrupted municipal services in Middletown, Ohio, in August 2025 and left utility billing impaired for months. The city’s later investigation notice confirmed files were removed by an unauthorized actor between July 29 and Aug. 17, 2025; discovery on Aug. 17 is distinct from that earlier access window.
We reported the city’s Aug. 18 announcement closing in-person police/public records, utility billing, income-tax and health-department services. The contemporaneous account also confirmed that 911 and scheduled Municipal Court proceedings continued. The City Council meeting proceeded without a livestream. These were substantial administrative disruptions, rather than a demonstrated loss of emergency response or water treatment.
Recovery was phased. The city’s Oct. 27 update reported restored phones, Wi-Fi and email, while staff still used backup processes. New utility bills could not be produced, and police fingerprint-based background checks remained unavailable. InvoiceCloud’s separate payment service could accept previously issued bills even while the city’s billing systems were impaired.
A November proposal for estimated bills was superseded by the January restoration announcement. The city said about 24,000 water customers would receive statements over the next four to five weeks and that incident-period payments were still being reconciled into online accounts. This documented continuing billing catch-up despite the return of the technical system.
The city’s billing FAQ confirms actual meter readings and reflected payments. It explains that autopay was disabled to prevent unintended collection of accumulated balances and could be re-enabled by customers. The grace period through Aug. 31, 2026 was payment relief, not evidence that billing systems remained offline until that date. Later customer complaints and the city’s response concern accumulated bills and support demand after restoration.
Confidence is high in unauthorized access, data removal and operational disruption because the city explicitly documented them. Its notice says a May 18, 2026 review identified personal information in removed files, including Social Security and government identification numbers, financial accounts and medical or insurance information. Notifications began June 3 where complete mailing addresses were available. The city reported no indication of resulting fraud.
Comparitech reported a Sept. 12, 2025 SafePay claim and 123,791 notified people. The primary city notice reviewed here gives no total, so that count remains attributed to the report. The city had not verified SafePay’s claim. Named-actor confidence is low and ransomware-related extortion confidence is medium; no reviewed evidence establishes encryption, a ransom amount or payment.
The entry method, specific malware, encryption scope, attacker identity, payment outcome and independently verified total affected population remain unestablished. No affirmative all-services restoration notice was found, including a precise return date for every police and administrative function.
The city spans Butler and Warren counties. Utility-billing disruption does not establish a loss of water treatment or delivery across either county.
Operations are presumed resolved based on elapsed time since the Jan. 16, 2026 observation of billing-statement rollout and payment-record recovery. Positive evidence supports return of water billing, but it does not date completion of every municipal recovery task. The exact end remains unset. Later repayment relief, breach notifications and customer support do not by themselves extend the operational clock.
SafePay listed the City of Middletown, Ohio using cityofmiddletown.org. MCP discovery is Sept. 12, 2025; later independent reporting describes a claim that day but no original post timestamp was verified. The city confirms unauthorized data removal, not SafePay responsibility, encryption or a ransom/payment outcome. The unrelated Middletown Township INC claim from 2024 is excluded. Existing claim repaired without duplication.
The city jurisdiction supplies governmental service context for closed public-facing offices, police-record services, tax administration and utility billing. It is not the exact water-service territory and does not establish a citywide loss of water delivery or 911.
Middletown is the administrative site anchor for affected City Building departments. Retains the existing municipality; no claim that every resident or physical utility-delivery system was disrupted.
Our report documented closed municipal in-person services after the Aug. 18 city announcement.
The report quotes the city’s late Aug. 18 announcement closing police records, utility billing, income tax and health-department in-person services.
The city restored phones, Wi-Fi and email but retained backup processes, could not create new utility bills and could not perform fingerprint checks.
The city said billing was restored, with statements for about 24,000 customers rolling out over four to five weeks and account-payment updates still pending.
Residents questioned accumulated bills; the city described four billing cycles, actual usage and reflected payments after mid-January restoration.
The city confirms Aug. 17 detection and files removed July 29–Aug. 17, 2025, with personal-data findings established May 18, 2026 and notifications beginning June 3.
The city identifies Central Avenue, Main Street Commercial, South Main Street, Oakland and Highland historic districts.
The county describes rural, urban and suburban communities, industrial development, Miami University and the former Voice of America relay station.
The report identifies a Sept. 12, 2025 SafePay claim, says the city has not verified it and reports 123,791 notified individuals.
The city places Middletown between Cincinnati and Dayton and identifies Great Miami Riverway, nature areas and local festivals.
The city confirms actual meter readings and that payments made during the incident are reflected in statements, with a grace period for accumulated charges.
Signed-in members can report an error, update, or missing source.
