Analyst assessment
A ransomware incident disrupted Tarrant, Alabama, city systems on Feb. 10, 2025. The city’s initial public warning said systems had been shut down, while the mayor’s statement reported by WBRC acknowledged ransomware and notification of federal authorities. The exact date of the first unauthorized access is unknown.
Operational significance
Police Chief Wendell Major subsequently described a more contained effect in an AL.com interview distributed by Government Technology. IT contractors took a server offline, repaired it and restored service. Police filed reports on paper, but record searches and other essential computer services remained available, he said. Separate departmental servers helped limit the impact.
The initial warning and the chief’s narrower assessment are both relevant. They establish an interruption and a manual reporting workaround without proving that every municipal service failed. There is no verified basis to describe delayed emergency responses, lost access to warrant checks or effects on Tarrant’s electric service.
IT director Christopher Smoke later told WIAT the city shutdown lasted 24 hours. Operational status is resolved on the restoration reporting, but an exact final restoration date is not established.
Confidence and uncertainty
Named city officials’ statements support high confidence in ransomware and operational disruption. The police chief described an attempt to extort money and said the city would not pay. That statement records the city’s position; it does not establish the amount demanded or independently document the eventual payment outcome.
Comparitech’s Feb. 17 report said RansomHub listed Tarrant and alleged theft of 28 gigabytes, with purported police documents offered as support. An exact-domain tracker listing names cityoftarrant.com and was discovered Feb. 15. Neither a listing nor alleged sample documents independently verifies the operator’s identity, theft volume or authenticity of every claimed record.
Analytic gaps
The entry route, confirmed data findings, affected-person count, ransom amount and incident-specific costs remain unverified. Generic expert estimates about typical recovery times and costs are not findings about Tarrant. The date of a later interview or syndicated report is not treated as a new day of disruption or as the restoration date.
