City of Mission
City of Mission ransomware attack
Summary
Ransomware disrupted Mission, Texas, on Feb. 28, 2025, encrypting servers and backups and blocking city records access. Emergency responders continued operating. The city later identified personal information in affected files; the exact recovery date remains unverified.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data encryption
Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
-
Backup compromise
Backup data or backup systems were accessed, encrypted, deleted, altered, disabled, or otherwise compromised.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Ransomware disrupted the City of Mission, Texas, on Feb. 28, 2025. In a catastrophe notice filed with the Texas attorney general, the city reported encryption of its server and backups and loss of access to records across every department. The notice establishes a disruptive ransomware incident; it does not identify the intruders or their entry method.
The city engaged outside cybersecurity specialists and notified law enforcement. Its March 4 employee memo described a partial network shutdown, while contemporaneous KRGV reporting relayed the city’s acknowledgment that some systems would remain offline during investigation and containment.
Operational significance
Unavailable records included birth certificates, police reports, contracts and personnel files. The city said it could not comply with Public Information Act deadlines, with a suspension initially covering March 1-7 and a listed extension through March 14. These are records-access and government-service effects, rather than proof that all municipal services stopped.
Police and other essential responders continued operating, according to the city statements reported by KRGV. Continued emergency response can coexist with unavailable administrative records. The mayor’s March 10 letter and disaster-declaration extension described inaccessible servers and activated continuing emergency measures.
A March 12 update reported progress toward bringing systems online and anticipated a return to full capacity. That expectation was not a restoration announcement. Progress Times reported March 21 that the city had described mitigation and recovery as ongoing in March 13 correspondence and expected the work to continue for months.
Confidence and uncertainty
Official records support high confidence in ransomware, encrypted backups and material disruption. In a later, undated city breach notice, Mission said unauthorized network access lasted a couple of days in late February. A subsequent review of affected files identified personal information, including identification, financial and limited medical details; review results arrived in November 2025, followed by efforts to notify affected people. The notice does not establish a public leak or an affected-person count.
The February 2026 IT report in the March 10 council packet lists eradication and recovery as complete and post-incident activity as ongoing. It does not identify the incident’s start date or give a dated restoration milestone. The incident is therefore assessed as presumed resolved, with no precise end date.
Analytic gaps
The exact initial intrusion date, entry vector, responsible group, demand or payment, affected-person count, complete recovery date and total response cost remain unverified. Current ransomware-lead searches under the city name, domain and police-department name returned no matching claim; this does not establish that no claim exists. The March 4 employee memo’s early identity-fraud reassurance should be read in its historical context alongside the later privacy findings.
Organizations involved
Impacted location
Mission, Texas
Paired with City of Mission government service_area. City records-access disruption affected municipal functions within its remit; emergency response continued, and no blanket citywide service outage is inferred.
Preserve valid existing Mission site nexus: city administration is based at City Hall in Mission, and original official notices describe inaccessible municipal IT and records across city departments. This city-level site representation does not assert every building closed.
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.