City of New Britain
New Britain ransomware and data breach
Summary
Ransomware disrupted New Britain municipal systems Jan. 28, forcing manual workarounds while emergency services continued. Later breach-notice reporting identified possible personal-data exposure affecting 10,339 Connecticut residents.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
DD-CIT assessment
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
New Britain, Connecticut, experienced a confirmed ransomware-related municipal network disruption. The city’s Jan. 29 advisory documented affected systems, outside technical assistance and continued public safety. WFSB reported ransomware confirmation and a network outage beginning about 5 a.m. Jan. 28. Ransomware confidence is high; the available evidence does not identify an actor.
Operational significance
Phone, network and computer disruption forced manual work in municipal departments. Police and fire response continued through backup and manual arrangements; public works and utilities continued essential services. Phased restoration began by Feb. 2, the last supported operational-impact date. The municipality overlays identify the government’s geographic remit, not a citywide loss of all services.
Data impact and chronology
CT Examiner reported Sept. 17 that a July filing by the city’s lawyers identified 10,339 Connecticut residents whose information may have been exposed. The reported intrusion window was Jan. 23–28; the city became aware of potential personal-data exposure Feb. 1 and notified affected residents March 27. These dates concern intrusion and notification, not final restoration. The filing itself was not directly inspected; its details are attributed to that reporting. The article’s combined two-city figure does not represent New Britain’s population alone.
Connecticut Public reported April 15 that an employee noticed unusual workstation activity. The city described limited unauthorized activity and possible access to records containing names, birth dates, identification numbers, financial details and health information. Monitoring and identity-protection services were offered. Possible exposure does not independently establish copied or publicly released data.
Response and financial context
Connecticut Public reported that the city consulted Cowbell Resiliency Services, evaluated response options including backups, and obtained enhanced monitoring under a three-year contract costing $66,000 annually. A spokesperson described a $25,000 cyberinsurance deductible. These are separate contractual and insurance figures, not a verified total incident cost or ransom payment.
Confidence, attribution and disclosure
Confidence is high that cyber activity caused municipal disruption and was characterized as ransomware. Reporting conveys the city’s acknowledgment of unauthorized activity and possible personal-data exposure. No independently verified city leak-site listing or named actor was found; a separate dental-practice claim in New Britain must not be conflated with the municipal incident. Concrete ransom demands, encryption conditioned on payment, actual exfiltration and ransom payment remain unestablished. Organization-confirmed cyber and disruption transparency, OC–OD, is retained.
Current status and gaps
The incident remains presumed resolved. Later coverage concerns investigation and notifications rather than ongoing operational disruption, and no incident-wide restoration date has been established. Preserve Feb. 2 as the latest documented impact and leave the end date unset. Initial access, specific affected systems, actual theft or encryption, demand and payment details, total losses and full restoration timing remain unresolved.
Organizations involved
Impacted location
New Britain, Connecticut
Municipal government service remit; inclusion does not establish an area-wide outage or loss of all services. Police, fire response and essential public works and utilities continued.
Sources
Initial report documents the Jan28 network disruption, outside investigation and continued public safety.
WFSB reported municipal system disruption and the continued operation of police and fire services.
The city said certain systems were affected, public safety remained operational and state and federal authorities were assisting.
Connecticut Public reported the city’s disclosure of limited unauthorized activity and possible personal-information exposure.
Reporting on breach notifications identifies 10,339 potentially affected Connecticut residents for New Britain and an intrusion window Jan23–28.
See something that needs correction?
Signed-in members can report an error, update, or missing source.