City of New Britain
New Britain ransomware and data breach
Summary
A ransomware attack disrupted New Britain municipal systems beginning Jan. 28, 2026, forcing manual workarounds while police and fire services remained operational. The city later said limited unauthorized activity may have exposed sensitive personal information.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
DD-CIT assessment
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data theft or exfiltration
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
Extortion indicators
-
Ransom demand
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
-
Encryption-based extortion
The extortion activity involved unauthorized encryption of systems or data, with restoration or decryption conditioned on payment.
Incident narrative
Analyst assessment
The City of New Britain experienced a confirmed ransomware attack that disrupted municipal systems beginning Jan. 28, 2026. The city’s Jan. 29 media advisory said certain systems were affected and that state and federal authorities were assisting. WFSB later reported that officials confirmed ransomware.
Operational significance
Phone and computer systems in multiple departments were disrupted, and some employees used pen and paper. Police and fire services remained operational. The city began a phased restoration by Feb. 2, but no public notice establishing a final restoration date was located.
Data impact
In April, Connecticut Public reported that the city found the unauthorized activity was limited in scope but that some records containing names, dates of birth, government identification numbers, financial-account information or health information may have been accessed. The city offered identity-protection services to potentially affected people.
Confidence and uncertainty
Confidence is high that ransomware caused operational disruption. The public record supports possible exposure of sensitive records but does not establish the full affected population, complete data inventory, initial-access method, ransom demand or payment. No named threat actor or independently verified leak-site claim was located.
Disclosure posture
City statements confirmed the disruption and response; subsequent public reporting attributed ransomware to city officials and described the potential data exposure.
Current status
The incident is presumed resolved because services entered phased restoration and later reporting focused on investigation and notification rather than a continuing outage. A final restoration date was not found.
Organizations involved
Impacted location
Sources
We reported network disruption, manual workarounds, ransomware confirmation and later data-breach disclosures.
WFSB reported municipal system disruption and the continued operation of police and fire services.
The city said certain systems were affected, public safety remained operational and state and federal authorities were assisting.
Connecticut Public reported the city’s disclosure of limited unauthorized activity and possible personal-information exposure.
See something that needs correction?
Signed-in members can report an error, update, or missing source.