Mitchell, South Dakota, shut down a limited network segment Aug. 6, 2026, after unauthorized activity. Services were restored by Aug. 12. On Sept. 28, the city said a small number of employees’ data were impacted and those affected were notified; it reported no indication of malicious data use. Storm’s claim remains unverified.
External sources identified the event as cyber-related before the organization publicly confirmed it. The organization publicly documents the resulting service disruption.
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Internal or external network connectivity was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
DysruptionHub assesses with high confidence that an unauthorized party affected part of Mitchell’s municipal network. In a Sept. 28 statement on the city’s website, Mayor Jordan Hanson confirmed unauthorized activity discovered Aug. 6, a forensic investigation and a small number of employees whose data were impacted. He said affected people were notified and offered credit monitoring and identity theft protection. The city has not identified an access method, data categories or the unauthorized party.
A ransomware.live record preserves a Storm leak-site claim naming the City of Mitchell and its cityofmitchellsd.gov domain. The captured actor page says the listing was posted Aug. 23, showed a pending status and an Aug. 28 deadline, displayed no uploaded file list, and presented 20 image thumbnails as proof. The listing establishes that Storm made a claim; it does not authenticate the images, prove that the material was obtained from Mitchell, or establish Storm’s responsibility, ransomware, encryption, data theft or a ransom demand.
The city shut down computers and a limited network environment Aug. 6 and began forensic review and remediation. Hanson said Sept. 28 that files were recovered and normal operations resumed within a short time. Our reporting documented the precautionary shutdown and restoration work while noting that the affected systems were not identified. Access to the city’s meeting-agenda platform was limited, establishing a public-facing effect in addition to the broader internal shutdown.
Mitchell said critical and emergency services were unaffected and fully operational. The city and Davison County websites remained accessible. The available evidence does not establish interruption to 911, public safety, utilities, payments, permitting, records access or other specific resident-facing services beyond the meeting-agenda limitation.
The documented sequence began with a Davison County warning that described city email service as hacked and was followed by the mayor’s affected-organization acknowledgement in reporting published Aug. 7. The county used definitive language about a hack and city email, while Mitchell used qualified cybersecurity wording and said it had no indication email was affected. The difference may reflect a precautionary county response, but the public record does not resolve the warning’s technical basis.
Storm’s Aug. 23 claim occurred after both the county warning and Mitchell’s cybersecurity acknowledgement. It therefore does not alter the existing external-first, then organization-confirmed disclosure sequence. The city’s Sept. 28 statement is a later confirmation of unauthorized activity and employee data impact, not a new onset.
The operational disruption is resolved. In an Aug. 12 written statement quoted by Government Technology, Hanson said the city was fully operational and all online systems were operating as expected. City staff could again post City Council agenda materials that day. Aug. 12 is the latest documented impact and recovery date; the later Storm claim and Sept. 28 disclosure do not extend the operational clock. The city said Sept. 28 that its investigation was complete.
Confidence is high that unauthorized network activity occurred and a small number of employees’ data were impacted because the mayor directly confirmed both in a city statement. He said there was no indication the data had been maliciously used. The Mitchell Republic reported, citing Hanson, that current and former employees were affected and city utility customers were not.
Ransomware involvement and Storm attribution are assessed with low confidence. The stable listing supports recording the claim and a leak-site indicator, but Mitchell, law enforcement, a regulator and independent technical evidence have not corroborated Storm’s responsibility. Employee data impact is confirmed, but the city has not identified the data categories or said whether data were exfiltrated. The visible thumbnails and the actor’s proof label do not establish whether the pictured documents were nonpublic, authentic, obtained from city systems or connected to this incident.
The name Storm is treated as the label used by the claimant’s leak site. The public evidence does not establish the operation’s identity, lineage, affiliate model or relationship to other unrelated threat-actor labels that use the word storm.
The public record does not identify the triggering detection, affected network segment, initial access vector, compromised account or host, exploited vulnerability, malware, persistence, dwell time, encryption, data categories, precise number of affected people, exfiltration, threat actor identity, ransom demand or payment activity. It also does not establish whether any city email account or message was compromised, how many systems were isolated, what the Storm thumbnails depict, or whether the actor communicated directly with Mitchell.
Storm’s leak-site listing names the City of Mitchell and its cityofmitchellsd.gov domain. The captured page shows an August 23 posting date, pending status, August 28 deadline, no uploaded file list and 20 image thumbnails presented by the actor as proof. Mitchell has not attributed the incident to Storm or confirmed ransomware, encryption, a ransom demand or data theft, and the listing does not authenticate the images or establish actor responsibility.
The affected organization is the municipal government serving Mitchell.
Our reporting found that Mitchell shut down a limited network segment while investigating a potential cybersecurity incident and restoring operations with forensic experts. Critical and emergency services remained operational, while the affected systems, unauthorized access, attack type, data impact, ransom demand and actor were not disclosed.
The Mitchell Republic reported a Davison County directive telling employees not to open city emails after a county official described the city’s service as hacked. Mayor Jordan Hanson said Mitchell was investigating a potential cybersecurity incident, shut down a limited network environment, engaged forensic experts and had no indication city email was affected. A TechSolutions manager said he was unaware of any related breach at Davison County offices.
Government Technology republished The Daily Republic’s report quoting Mayor Jordan Hanson as saying Aug. 12 that Mitchell was fully operational and all online systems were operating as expected. The report said city computers had been shut down Aug. 6 and access to the meeting-agenda platform was limited until staff could post materials again Aug. 12.
Ransomware.live preserves a Storm listing naming the City of Mitchell and its cityofmitchellsd.gov domain. The captured actor page says it was posted Aug. 23, shows a pending status and Aug. 28 deadline, displays no uploaded file list, and presents 20 image thumbnails as proof. The record does not authenticate the images or establish Storm’s responsibility, ransomware, encryption, data theft or a ransom demand.
Mayor Hanson says a small number of current and former employees were affected, were notified the preceding week and offered protective services; no city utility customers were affected.
The mayor confirms unauthorized activity Aug. 6, limited network impact, recovered files, completed investigation, and notifications and protective services for a small number of affected employees.
Signed-in members can report an error, update, or missing source.
