Richland, Washington, discovered unauthorized access to city servers on May 15, 2024, and took some systems offline during its response. Municipal services were disrupted, including online and telephone utility payments.
Analyst assessment
The city’s initial disclosure, republished by the regional chamber, identified access through Benton County Emergency Services servers. Its public Facebook notice includes the May 17 disclosure and a May 20 update warning of temporary system shutdowns. These statements establish cyber involvement and operational effects.
The city’s subsequent regulatory notice identifies May 11–15 as the unauthorized-access window. That period describes system compromise, rather than the duration of service disruption.
Operational significance
The city’s May 24 service notice said online and telephone utility payments were unavailable. Customers could pay in person with cash or checks; late fees and shutoffs were suspended during the disruption. Contemporary reporting records most services and utility payments available again by May 31.
The permitting office’s May 28–31 closure and June 3 software launch had been announced April 5, before the intrusion. The city’s current permitting page confirms the June 3 implementation. That scheduled transition is not evidence that the cyberattack kept permitting unavailable through the end of May.
The involvement of emergency-services servers does not establish that emergency calls or dispatch failed. The city reported that its own servers were principally affected.
Confidence and uncertainty
Confidence in the intrusion and municipal service disruption is high. The historical incident is presumed resolved, with no verified exact date of full restoration. The May 24 city notice is the latest direct evidence of continuing attack-related payment restrictions; May 31 is a subsequent recovery checkpoint. The preplanned permitting transition and later breach notifications do not extend the operational-impact period.
The regulatory notice says information may have been accessed or taken and that approximately 1,700 Washington residents were notified on or about Oct. 31, 2024, revising an earlier estimate of 1,618. Potentially affected information varied by person and included identity, financial and health-related data. This is a state-resident notification count, not an established nationwide total or proof that every listed data category was affected for each person.
Secondary reporting describes ransomware, but the city notices do not establish encryption or a specific perpetrator. Ransomware.live records an INC Ransom listing for “Richland City Hall,” identifying the older richland.wa.us domain. The tracker recorded discovery on May 22; the original posting date is unverified. Contemporary Comparitech reporting also described the May 22 listing and apparent city documents in a proof pack. These are reported allegations, not independently verified responsibility, encryption or data-theft scope. The public record does not establish a ransom demand or payment.
Analytic gaps
The initial access technique, complete affected-system inventory, date of full service restoration, extent of any emergency-service interruption, definitive data-theft findings and independently verified actor attribution remain unresolved.
