City of Odessa
Odessa cyber incident disrupts billing and court services
Summary
A cyber incident disrupted Odessa municipal billing, payment channels, phones and court workflows in November 2024. Recovery restored billing in stages, with account-processing problems continuing into January 2025.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Malware
Malicious software other than ransomware used to compromise or disrupt systems.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Facility closure
One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Backlog created
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Municipal systems were disrupted
The City of Odessa, Texas, identified a cyber incident overnight Nov. 20, 2024. Its Nov. 21 announcement said billing and municipal court offices were closed and several payment channels were unavailable. Court staff used paper magistration procedures.
A city spokesperson later described a malicious script that had been removed, while further cleaning and recovery work continued.
Payment and communications workarounds
The city reported continuing system limitations Dec. 2. Residents could bring checks or money orders to City Hall while online, kiosk and other payment options were unavailable. The city suspended late fees and disconnections during the disruption.
In a Dec. 4 update, officials described restoration from secure backups, state-provided security software and an outside investigation. Phone and account-access problems continued. The city’s catastrophe notice also documented interference with public-information requests.
Billing recovery remained incomplete
KOSA reported Dec. 20 that billing was running again and residents would receive combined November and December bills. That milestone did not resolve every account-processing problem.
A Jan. 16, 2025, city update said two systems were not communicating properly, affecting more than 43,000 billing customers. More than 5,600 automatic-payment accounts had been debited by banks without the payments appearing in the customer portal. Those figures describe billing customers and accounts, not stolen records.
Further reporting Jan. 22 described continuing integration problems after system cleanup. The reviewed sources do not establish an exact date when all effects ended.
Investigation and limits
Officials investigated the incident and implemented recovery and security measures. An early city assurance that no data had been stolen was not a final forensic determination. The reviewed sources do not establish ransomware encryption, a named attacker, a ransom payment or final personal-information findings.
Later billing errors and related litigation involved additional reported causes. They do not independently establish that this cyber incident continued or account for its total cost.
Organizations involved
Impacted location
Odessa, Texas
The exact city geography represents the affected municipal authority’s service remit. Documented billing, payment, court and phone disruption does not establish that every resident, public-safety function or water-delivery service was unavailable.
City Hall at 411 W. Eighth Street is the verified physical municipal administration and payment-workaround site. Original updates directed check/money-order payments there during the outage. This site anchor does not locate compromised servers or imply that Ector County’s separate offices were affected.
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.