City of Saratoga Springs
Saratoga Springs cyber incident disrupts city systems and dispatch
Summary
A June 2024 cyber incident led Saratoga Springs, New York, to take municipal computers offline, disrupting email and records access and moving dispatch functions to the county. Officials said public safety continued and ransomware was not involved. The exact full-restoration date is unverified.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Email disruption
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Authentication disruption
Users were unable to authenticate, sign in, access accounts, or use identity-dependent services.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Dispatch disruption
Dispatch, routing, assignment, coordination, or response-management functions were unavailable or materially impaired.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
-
Customer or public access restricted
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
Extortion indicators
-
No known extortion indicator
Available evidence indicates that no extortion demand, threat, communication, or related pressure tactic was identified.
Incident narrative
Analyst assessment
A cyber incident disrupted Saratoga Springs, New York, municipal computing in late June 2024. Officials activated emergency protocols and took networked computers offline after a police officer could not access an account. The city’s June 26 special-meeting minutes record IT difficulties beginning June 25 and a multiagency investigation.
A legal notice in the June 27 meeting packet describes a potential data-security incident dated June 25. This qualified acknowledgment confirms cyber involvement without establishing a successful intrusion or technical cause. Officials said ransomware was not involved.
Operational significance
The minutes describe employee desktops and laptops being offline, slowing public services while computers were restored. The city website remained available. Times Union reporting also identified email and electronic-records access problems, with telephone contact offered as an alternative.
Police dispatch staff and emergency-call handling temporarily moved to Saratoga County Sheriff’s Department facilities as a precaution. County dispatch was still handling these functions June 26, and officials said public safety was maintained. The workaround does not establish that emergency response failed or that the county was compromised.
WNYT’s June 27 report documented the continuing shutdown and an expected June 28 restart. That expectation was not a completed-restoration announcement. The historical incident is presumed resolved, with its exact recovery date unestablished.
A signed Sept. 17 council resolution authorized a $2,827.50 insurance retention payment to Mullen Coughlin LLC. The accompanying draft minutes tied the invoice to the June cyber incident. The authorization documents a response cost without establishing the city’s total costs or when payment was made.
Confidence and uncertainty
Confidence is high that municipal systems were disrupted and that officials treated the event as cyber-related: city records and contemporaneous reporting corroborate those findings. June 25 describes detection and response, while June 26 is the first verified public disclosure; neither establishes the precise time of initial malicious activity.
City leaders said there was no data breach, and the finance commissioner rejected ransomware as the cause. These are attributed official findings. Temporary inability to access records does not establish theft, deletion or encryption, and the public record does not include a technical forensic report resolving every aspect of the event.
Analytic gaps
The initial-access method, identity of any attacker and exact restoration date remain unknown. Officials’ cooperation with the FBI and state agencies does not identify an operator or establish a ransom demand or payment. Later response costs do not independently extend network downtime. The separate Saratoga Casino incident and July CrowdStrike outage are distinct events.
Organizations involved
Impacted locations
Saratoga County, New York
Saratoga County contains the affected city’s administrative offices at City Hall. This site-level county anchor represents that physical presence, without asserting county-government compromise or countywide disruption. County dispatch assistance is a response measure, not evidence of an additional victim.
Saratoga Springs, New York
Saratoga Springs contains the affected municipal government’s City Hall at 474 Broadway. This physical administrative anchor is separate from the city’s governmental service overlay. It does not locate the intruder or a particular compromised server.
The city boundary represents the affected municipal government’s service area. Networked city computers, email and electronic-record access were disrupted; the overlay does not establish an outage at every address. County-assisted dispatch continued as a precaution and does not expand the affected municipal remit.
Sources
We reported that the cyber incident disrupted city email and electronic-records access, while police dispatch used county facilities and public safety functions continued.
Official city statement dated June 26, 2024, stating that health and safety functions were being fulfilled, City Hall remained open with potentially limited services, and the city network was taken offline ‘in an abundance of caution’ to facilitate an ongoing investigation.
Reports that the FBI was taking a lead role and that emergency protocols were triggered after a police officer could not access an account. Includes a timestamped reference to an overnight city statement and quotes city officials on operational impacts (e.g., network offline, email/IT functions affected) and mitigation steps (e.g., rerouting dispatch).
Summarizes city leaders’ public characterization of the incident as a network disruption rather than a data breach and reports the stated expectation that all networks/departments would be back online by Friday, June 28, 2024, while the FBI investigation continued.
The federal place dataset contains the Saratoga Springs city boundary, identified by GEOID 3665255.
The federal county dataset identifies Saratoga County by GEOID 36091.
The city’s current official homepage identifies Saratoga Springs municipal services and its government website.
The department’s patch history describes the city’s mineral springs and the mound of deposits at High Rock Spring.
The county historian describes Saratoga County’s 1791 formation from Albany County, its Adirondack landscape, river boundaries and historic canal corridors.
The City Council comprises the mayor and commissioners of accounts, finance, public works and public safety.
The municipal code-enforcement page records the city’s incorporation in 1915 and lists City Hall contact information.
The mayor’s office describes its representative, presiding and appointment duties and lists City Hall at 474 Broadway.
A signed Sept. 17, 2024, resolution authorizes a $2,827.50 insurance retention payment to Mullen Coughlin LLC. Accompanying draft minutes record a 4–0 vote and tie the invoice to the June cyber incident.
Agenda packet and legal notice for the June 27, 2024 special City Council meeting. The legal notice (dated June 26, 2024) states the meeting’s purpose was to review and execute documents related to a ‘potential data security incident on June 25, 2024,’ anchoring the incident date in an official municipal record.
Minutes of the June 26, 2024 special City Council meeting convened to discuss the city network disruption. Records officials stating the I.T. issue was first identified during the 4 o’clock hour on June 25, 2024, followed by emergency-response measures and multi-agency involvement; notes employee computers were taken offline and police dispatch was temporarily routed to Saratoga County.
See something that needs correction?
Signed-in members can report an error, update, or missing source.