The City of Sheboygan, Wisconsin, discovered a network issue on Oct. 31, 2024, and isolated its IT network. Its Nov. 7 statement said specialists were assessing the problem and restoring functionality. Telephone lines remained available for people seeking city services.
On Nov. 10, the city confirmed unauthorized external access and a ransom demand. It said the network had been secured and forensic work continued. Containing access did not establish that every service had returned to normal.
The city’s Nov. 22 update acknowledged that unauthorized users had named it in a post and shared a screenshot listing file archives. Officials said no data had been publicly posted and no sensitive-data theft had been identified at that stage. Those findings were provisional.
Library board minutes from Nov. 20 describe effects across most city departments. Library Director Garrett Erickson said staff from several agencies were working from the library. The finance department had little access to municipal financial software, preventing preparation of budget reports. A report expected at the January meeting was a forecast, rather than proof of restoration.
A Dec. 17 update described continuing investigation and council-approved network upgrades. It did not identify an exact restoration date. Nov. 20 is the latest specifically dated operational impact established in the reviewed records. Later investigation and security spending do not establish continuous operational disruption.
The city later acknowledged an encryption event and affected personal information. WBAY’s June 5, 2025, report describes the city’s May 28 notice: the encryption event occurred Oct. 31, officials learned on May 14 that personal information was affected, and notification letters were mailed May 23. May 14 was a later data-review finding, rather than the initial discovery of the network incident.
Indiana’s breach register records 67,947 affected people, including 124 Indiana residents. The total should not be described as city residents. The Record reported stolen information that included Social Security numbers, state IDs and vehicle information. Information affected varied; the reviewed Massachusetts letter does not enumerate individual fields.
The Record identified a claim by Chort. A ransomware.live entry for sheboyganwi.gov was observed by the tracker Nov. 22; that timestamp does not establish the exact criminal posting or intrusion date. The claim remains distinct from confirmed attribution. The reviewed city statements do not establish a ransom amount, payment or initial access method.
The operational incident is presumed resolved because of the time elapsed and absence of a verified current outage. The exact final restoration date remains unknown. Network containment, later data notification and continuing forensic work are separate milestones.
