A June 10, 2024, cyberattack disrupted Newburgh’s municipal payments and administrative services, closing public counters for several days. A July statement confirmed restoration and reported no evidence that sensitive resident or employee information was affected.
Unauthorized access to systems, accounts, networks, or data.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
The organization could not process, receive, issue, reconcile, or record payments normally.
Business, financial, customer, administrative, or operational transactions could not be completed normally.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
Newburgh, New York, detected and stopped unauthorized access to city systems on June 10, 2024. Its initial notice described interrupted municipal services and outside technical assistance. The city’s acknowledgment establishes a disruptive cyberattack; the available official statements do not confirm encryption or identify the attacker.
Public counters at City Hall and 123 Grand Street closed, and the city could not process taxes, utility payments, permit fees or parking tickets. Telephone and email responses could be delayed. News 12 reported June 12 that the county supplied emergency laptops and communications equipment, and state police covered city calls for five hours. Emergency lines and 911 remained available. The city’s later statement that public safety services continued should be read alongside this reported assistance.
The June 14 reopening notice scheduled public counters, telephone and email service to resume June 17, with payments returning in phases over the following seven to 10 days. These were planned milestones, rather than confirmation of complete restoration. June 18 planning-board minutes document delayed project-review comments: planning letters had just become available, while engineering letters were still to follow.
The city’s July 10 conclusion statement confirmed restoration of affected public services and administrative functions, supporting resolved operational status without an exact restoration date. It reported no evidence that sensitive resident or employee information was affected and no signs of continuing malicious activity.
Orange County Executive Steve Neuhaus told News 12 that the city had received a ransom demand. The reviewed evidence does not establish whether payment occurred or identify the demand’s sender. Two BlackByte listings tracked by ransomware.live remain unverified allegations. They do not independently establish encryption, stolen records or official attribution, and their discovery dates do not establish when the claims were published.
The initial access method, precise full-restoration date, the demand amount, any payment or negotiations, final recovery cost and the relationship between BlackByte’s claims and the confirmed intrusion remain unresolved. The city’s finding concerns sensitive personal information; it should not be expanded into a claim that no unauthorized access occurred.
Ransomware.live records a BlackByte listing naming Cityofnewburgh-ny.gov, discovered June 22, 2024. The discovery date is not the attack’s onset or the original claim’s publication date. The city has not confirmed the actor and reported no evidence of sensitive personal-information impact.
Ransomware.live records a BlackByte listing naming City of Newburgh, discovered June 22, 2024. The discovery date is not the attack’s onset or the original claim’s publication date. The city has not confirmed the actor and reported no evidence of sensitive personal-information impact.
Municipal service jurisdiction for the affected city. Payment and administrative services were disrupted; emergency services remained operational.
Newburgh anchors the affected city government’s offices and public counters.
The city identified a June 10 network incident, could not process several municipal payments, and closed public counters. Emergency lines and 911 remained functional; telephone and email response delays were possible.
County Executive Steve Neuhaus said Newburgh received a ransom demand and emergency equipment. State police said they covered city calls for five hours. The report does not establish payment, encryption or attacker identity.
The city scheduled counters, phone and email service to reopen June 17, with payment processing phased back over seven to 10 days. Department operations continued with minor disruptions and 911 remained functional.
The city said affected public services and administrative functions were restored. Its investigation found no evidence of sensitive resident or employee data impact and no signs of continuing malicious activity.
The city confirmed restoration of affected services and administrative functions and reported no evidence of sensitive personal-information impact or continued malicious activity.
The tracker lists City of Newburgh under BlackByte with the city’s domain. This is an attribution allegation, without independently confirmed encryption or stolen-data scope.
The assistant corporation counsel attributed delayed city-planner and engineer project-comment letters to the security breach. Planning letters were just ready at the meeting; engineering letters would follow when completed.
Signed-in members can report an error, update, or missing source.
