City of North Miami
North Miami ransomware attack
Summary
An August 2024 ransomware attack closed North Miami City Hall and disrupted billing, permits and police data systems. Emergency response and payroll continued. The city later reported billing fully restored by May 2025; an exact end date for all affected services is unverified.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Database unavailable
A database or data-management system became unavailable or inaccessible.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Dispatch disruption
Dispatch, routing, assignment, coordination, or response-management functions were unavailable or materially impaired.
-
Public safety operations disrupted
Police, fire, emergency medical, corrections, emergency management, or other public-safety operations were materially affected.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Facility closure
One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.
-
Event or activity cancellation
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
-
Customer or public access restricted
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
Extortion indicators
-
Ransom demand
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
Incident narrative
Analyst assessment
A ransomware attack affected North Miami’s municipal network Aug. 4, 2024. The city’s operations notice confirms City Hall closed Aug. 5-9 and reopened Aug. 12 with limited services. The reopening did not establish that affected systems had recovered.
The city’s 2025 annual report, on page 26, says billing operations were fully restored by May 2025. The incident is presumed resolved, but the exact date when all affected services recovered remains unverified.
Operational significance
Initial disruption interrupted permits, payments, billing and passport services. Reporting on the partial reopening described cash, check and money-order payments, plus paper records and radio workarounds for police. Emergency response, including 911, continued, according to the city.
A Justice Department assessment updated Sept. 26, 2024 said police could not use their data systems or databases except email, complicating basic work. The city’s fiscal 2024 financial report also documents interrupted utility billing and delayed financial reconciliation. It says payroll and vendor payments continued.
Confidence and uncertainty
Ransomware confidence is high because the city identifies it in its financial report. In a September interview, Mayor Alix Desulme described efforts to extort the city and residents. No responsible group was established in the reviewed evidence.
Accounts of initial access differed. Early reporting suggested a possible connection to the mayor’s personal email; his later account described a message clicked within city systems. Neither establishes a verified forensic entry route or the scope of municipal data theft.
Analytic gaps
The billing recovery statement provides a month-bound milestone, rather than an exact end date. The financial report’s references to data retrieval describe an availability problem without establishing permanent destruction. The attack compounded existing collection problems; the entire receivables balance cannot be attributed to it.
The city’s original public-notice chronology, complete restoration of police systems, any municipal data exfiltration and the ransom-payment outcome remain unverified. Archived notices retain older meeting information, and current publisher timestamps differ from some article URL dates, limiting precise chronology.
Organizations involved
Impacted locations
Miami-Dade County, Florida
Miami-Dade County contains the affected city’s administrative headquarters at North Miami City Hall. This physical-site relationship locates the municipal victim and does not identify county government as affected.
North Miami, Florida
North Miami is the affected municipal government’s jurisdiction. Its council-manager government and four council districts establish the city remit. This area relationship represents that jurisdiction and does not imply uniform disruption across all services or residents.
North Miami contains City Hall at 776 NE 125th St., including the city manager’s office, mayor and council offices and council chambers. This physical-site relationship is separate from the municipal service area.
Sources
We reported City Hall’s closure and interruptions to permits, payments, billing and passport services after a possible cyber breach. Our report described continued emergency response and the mayor’s manual payroll measures.
North Miami acknowledged a possible network breach after City Hall closed and online water-bill payments became unavailable. The city said emergency response, including 911, remained operational.
The city acknowledges disruption to internal systems and says the investigation into affected data is ongoing. It announces plans to reopen City Hall Aug. 12 with limited services.
City Hall reopened with computer access and online services still unavailable. Residents paid with cash, checks or money orders, and police relied on paper and radios.
Mayor Alix Desulme described attempts to extort residents and the city after the ransomware attack. He said an employee clicked a message before attackers gained control of city networks.
City Hall closed Aug. 5-9, 2024, and reopened Aug. 12 with limited services after the cyberattack. The city said emergency response continued.
The city’s fiscal 2024 financial report documents ransomware, interrupted utility billing and difficulties retrieving and reconciling financial data. Payroll and vendor payments continued.
A federal assessment said the August 2024 cyberattack left North Miami police unable to access data systems and databases except email, complicating basic police work while the city restored systems.
North Miami’s 2025 annual report says billing operations were fully restored by May 2025.
See something that needs correction?
Signed-in members can report an error, update, or missing source.