Skip to content
DysruptionHub
Sign in Subscribe

Network intrusion prompts Noblesville to take systems offline

Summary

City of Noblesville logo

Noblesville, Indiana, took some systems offline after detecting a network intrusion in November 2024. The city confirmed personal information was acquired, and a state register lists 1,841 affected people.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High
Ransomware:
Unresolved
Attribution:
Unresolved

Attack mechanisms

Data impacts

  • Data theft or exfiltration

    Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

Incident narrative

What happened

The city of Noblesville, Indiana, detected a network intrusion on or about Nov. 22, 2024, and took some systems offline. Its posted notice says the city engaged outside specialists and notified law enforcement. Investigators established Nov. 27 that an unauthorized party had accessed and acquired personal information.

A city statement posted Nov. 27 acknowledged that some systems had been affected and that a forensic investigation was underway.

Operational significance

The protective disconnection interrupted the availability of some municipal systems. Officials did not identify the affected applications or describe the consequences for particular services. The reviewed notices do not establish how long those systems remained offline or give a final restoration date.

Confidence and uncertainty

The city confirms both an intrusion and unauthorized acquisition of information. The Indiana attorney general’s breach register lists 1,841 affected people, including 1,797 Indiana residents. It records Oct. 22, 2024, as the breach date and Jan. 7, 2025, as the notification date. The filed breach date and the city’s later detection date describe separate milestones; the full access period remains unclear.

Comparitech reported that Interlock claimed responsibility and alleged theft of 4,140 GB, including a database containing employee, police and emergency-service information. Officials had not verified the group’s attribution or alleged contents. The reviewed evidence does not establish encryption, a ransom amount or payment.

Analytic gaps

The initial entry method, precise scope of affected information and operational recovery timeline remain unresolved. The reported database contents do not establish disruption to police or emergency response. An ongoing forensic review does not establish continuing service outages.

Threat actor and claim

Interlock

Listed as: City of NoblesvilleSource: ransomware.liveDiscovered:

Claim details

Interlock claimed responsibility and alleged theft of 4,140 GB, including an SQL database with employee, police and emergency-service information, according to Comparitech’s Dec. 20, 2024, report. Officials had not verified the group’s attribution or alleged contents. The city independently confirmed unauthorized acquisition of personal information but did not identify Interlock or confirm encryption. The tracker observed the listing on Dec. 20 UTC; this is not a verified original actor-post publication time. No ransom amount or payment is established.

Organizations involved

Impacted location

  • Noblesville, Indiana

    The affected entity is the city government, so Noblesville is its geographic remit. The paired organization service area records the same scope. Only some municipal systems were taken offline; no citywide public-safety, water or household outage is established.

    Noblesville contains the affected city’s verified administrative offices. This municipality-level physical anchor does not establish closure of City Hall or an outage at every city facility.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.