City of Richardson
Cyberattack disrupts Richardson, Texas, city systems
Summary
An unauthorized user accessed Richardson, Texas, city servers Sept. 25, 2024, and attempted to encrypt files. The city restricted access, replaced equipment and restored backups. Initially available public services later experienced connection outages during recovery, affecting payments, permits, customer requests and other online functions. Staff used manual bulky-waste reporting and collection workflows. Intermittent outages were still described Oct. 11; the city confirmed full network and online-service restoration by Oct. 16. Data theft, a named attacker, a ransom demand and payment remain unverified.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Transaction processing disruption
Business, financial, customer, administrative, or operational transactions could not be completed normally.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Intermittent service disruption
Services or systems experienced recurring, unstable, or temporary periods of unavailability.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Richardson, Texas, said an external party accessed city servers at 6:22 a.m. Sept. 25, 2024, and attempted to encrypt network files. Its public statement says automated controls limited the impact to a small number of files, while the city restricted internal access and began replacing equipment and recovering backups.
Confirmed unauthorized access and the city’s documented access restrictions establish a disruptive cyber incident. The Record described an attempted ransomware attack, but the directly reviewed city notices do not name the program or establish a ransom demand. Ransomware confidence is therefore low, and the attacker remains unresolved; attempted encryption is not proof of widespread completed encryption.
Operational significance
The first city notice and its social statement said emergency response, online payments and customer portals remained available. That was an early status report. The Sept. 26 notice announced a 6 p.m. shutdown of network communication lines for validation and recovery, with online payments, permits, requests and ticketing expected to lose connectivity. Some externally hosted systems, including recreation registration and police alarm permits, were expected to continue.
The Sept. 27 city update confirms the shutdown had occurred and describes bulky-waste staff manually taking reports and collecting street by street. Potential collection delays were a forecast, while the manual workflow was already in use. Emergency response remained available. The same bulletin said the Eisemann Center was accepting in-person payments only in cash because of system outages.
Confidence and uncertainty
The Oct. 4 update says internal communication lines were re-established Monday, Sept. 30, but staged recovery still caused intermittent outages affecting utility-billing connections and the response telephone line. It distinguishes unaffected payment systems from their disrupted website and mobile-app connections. This supports service-access effects without asserting the underlying billing application was compromised.
On Oct. 11, the city still described recovery-related intermittent outages and directed users to retry access or seek in-person help at the annex. Its Oct. 16 restoration announcement confirms the network and online services were fully restored after three weeks of rebuilding. The reviewed wording establishes restoration by that announcement, without specifying a separate exact completion date.
Analytic gaps
The initial statement that there was no early indication of sensitive-data access was provisional. The reviewed evidence establishes unauthorized network access and restricted file availability, but not a verified volume of stolen information, publication, a named operator or payment. Exact city-name and domain tracker searches returned no matching lead; two broad Richardson hits concern unrelated private organizations.
Sept. 25 is both the stated event date and the earliest verified institutional disclosure. The city notice’s recorded 5:09 p.m. Central publication precedes a KRLD report published at 5:53 p.m. that day, which attributes the intrusion and attempted encryption to the city. This supports organization-first cyber characterization and organization-documented disruption. Oct. 11 is the latest dated statement of ongoing effects; resolved status is supported by the Oct. 16 confirmation, while the exact end date remains unknown. The initial access method, file-level outcome and final data-review findings remain unknown.
Organizations involved
Impacted location
Richardson, Texas
The affected municipal government serves Richardson across parts of Dallas and Collin counties. Documented service effects varied by function and stage of recovery.
The city offered in-person help at its temporary annex on Campbell Creek Boulevard in Richardson while online services experienced recovery-related interruptions.
Sources
Richardson reported unauthorized access to city servers and attempted file encryption Sept. 25, 2024. Internal access was restricted while equipment replacement and backup recovery began. Its initial statement said emergency response and public customer portals remained available.
The city said an external party accessed its servers at 6:22 a.m. Sept. 25, 2024, and tried to encrypt files. Security controls limited the effects, and officials restricted internal access while replacing equipment and restoring backups. Sensitive-data findings were preliminary.
KRLD reported Richardson’s server intrusion, attempted encryption, restricted internal access and recovery work Sept. 25, 2024. It attributed the information to the city and said essential public services remained available at that early stage.
The Record described an attempted ransomware attack and cited Richardson’s statement about unauthorized access, attempted encryption, restricted internal access and backup recovery. The city had not identified the program, attacker or a ransom demand in the reporting.
Richardson announced a planned shutdown of internal network communication lines for 6 p.m. Sept. 26, 2024, to validate and restore systems. Online payments, permits, service requests and ticketing were expected to lose connectivity. The estimated 72-hour interruption was a forecast.
Richardson confirmed the previous day’s network shutdown and manual bulky-waste reporting and street-by-street collection. The same bulletin said the Eisemann Center was accepting in-person payments only in cash because of system outages. Collection delays remained a forecast.
The city said internal communication lines had been re-established Sept. 30, but staged network recovery still caused intermittent outages involving its response telephone line and utility-billing connections. Payment applications were not directly affected; their website and mobile-app connections were disrupted.
Richardson said network recovery continued and could cause intermittent website and mobile-app connection outages. It advised users to retry, seek in-person assistance at the temporary annex or use a backup response telephone number.
Richardson confirmed full restoration of its network and online services after three weeks of recovery. Teams rebuilt systems from scanned and secured backups. The announcement establishes restoration by Oct. 16, 2024, without identifying a separate exact completion date.
Richardson’s public social statement described unauthorized server access, attempted file encryption, restricted internal access and backup recovery. Its initial account said essential public services remained available. The post’s exact publication date has not been independently established.
Richardson’s incident FAQ describes attempted file encryption, restricted internal access, backup recovery and FBI involvement. It says utility-billing connections could be intermittently unavailable and payment posting could be delayed even though the underlying billing system was unaffected. Its data assessment remained preliminary.
See something that needs correction?
Signed-in members can report an error, update, or missing source.