A June 2025 ransomware attack disrupted Thomasville, North Carolina’s municipal network, electronic records and utility billing; the mayor acknowledged data removal and corruption. Essential services continued through workarounds, and October 2026 reporting described police records modernization and restored field reporting. The incident is presumed resolved, with the full restoration date and data scope unresolved.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Data became damaged, inconsistent, unreadable, or unreliable as a result of malicious activity or incident-related system effects.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Internal business, administrative, operational, or staff-facing systems were unavailable.
The organization could not process, receive, issue, reconcile, or record payments normally.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.
A June 9, 2025, cyberattack disrupted the City of Thomasville’s municipal network, access to electronic records and utility-billing workflows. The city’s initial notice acknowledged suspicious activity and an outside investigation. In his July 24 open letter, Mayor Raleigh York Jr. said attackers removed and corrupted a significant amount of data across departments. We reported the initial investigation on June 12.
DysruptionHub assesses ransomware involvement with high confidence based on WXII’s reporting, the city’s account of corrupted servers and its response to extortion. INC Ransom separately claimed responsibility. Comparitech reported a claimed 250 GB theft, while Cybernews reported 260 GB. The mayor’s acknowledgment supports data removal, but does not authenticate the claimant’s volume, samples or identity; confidence in INC attribution remains low.
The mayor described staff losing almost all connectivity to electronic data and using workarounds to maintain essential services. Utility bills initially could not be processed; modified bills were being processed and mailed within two weeks of the attack. The city’s July 2 notice suspended automatic drafts and directed customers to other payment channels. On July 24, the mayor said bank drafts still malfunctioned for most autopay customers. His 45-day target concerned restoring standard bills and automatic drafting, rather than a confirmed deadline for recovery of every municipal system.
October 2026 reporting by the High Point Enterprise described effects on police department operations and a replacement records platform following a cyberattack. In that report and an Oct. 13 Mark43 release, Chief Dustin Carter said the old records system could not communicate with the county’s computer-aided dispatch system, forcing officers to return to headquarters to complete reports. The deployed records, mobile and analytics tools restored field-reporting capability. The accounts do not establish when the compatibility problem began or that the attack caused every limitation of the old system.
The city’s initial statement said essential public-safety services continued. The mayor said critical-system data and controls were not directly affected, with earlier cloud migrations helping protect some functions. Continued essential services therefore coexisted with disrupted administrative workflows; the evidence does not establish a loss of water delivery, a dispatch outage or interruption of emergency response.
The initial release is datelined June 10 and indexed by the city on June 11, the earliest independently supported public cyber acknowledgment. The mayor dates the attack to June 9; WXII describes discovery on June 11. The city acknowledged cyber activity before the publicly reported INC claim. The mayor’s July letter documents more extensive disruption and data removal than the initial release, when sensitive-information compromise was unresolved.
The incident remains presumed resolved. July 24, 2025, is the latest clearly dated observation of ongoing municipal disruption. The October 2026 police deployment is evidence of modernization and restored reporting capability, but supplies neither an exact restoration day nor a citywide all-clear. It does not establish uninterrupted service disruption throughout the intervening period.
Confidence is high in the cyberattack, data corruption and administrative disruption because the city directly acknowledged them. The mayor’s letter also establishes the city’s report of data removal, while the affected categories, number of people and validated volume remain unknown. On July 24, the city said it was not paying a ransom or communicating with the attackers and had hired a data-recovery specialist to work on corrupted servers. That statement records its position at the time; it does not resolve the ultimate data findings.
The public record does not establish initial access, dwell time, encryption scope, the exact information removed, a final breach-notification population, total costs or the date all affected municipal services returned to normal. The police platform accounts do not identify the attack’s date or quantify lost patrol time. INC attribution and the conflicting 250 GB and 260 GB allegations remain unverified.
INC Ransom claimed the City of Thomasville June 2025 incident. Comparitech reported a 250 GB allegation and purported document samples; Cybernews reported 260 GB and a July 1 listing. The conflicting volumes, sample authenticity and INC attribution are unverified. The mayor separately acknowledged data removal and corruption without identifying INC or validating either volume. Original claim publication timestamp and direct leak-post URL remain unverified.
Municipal service remit of the affected government; does not imply every resident or all services were disrupted.
Physical municipal anchor at City Hall in Thomasville; no building-specific damage is asserted.
We reported that Thomasville was investigating a June 9 attack on municipal systems, with outside cybersecurity assistance and public safety services continuing.
The city described suspicious activity in municipal systems, containment and outside investigation. Sensitive-information compromise was undetermined, and essential services remained operational.
Comparitech documented an INC claim against Thomasville alleging 250 GB stolen and showing purported document samples. The city had not confirmed that data-theft allegation.
The city instructed customers to pay modified mailed invoices through alternative channels because normal automatic bank drafts would not occur while systems were being restored.
WXII reported ransomware involvement and continuing network rebuilding.
The mayor said June 9 attackers removed and corrupted data across departments. Modified utility bills were mailed within two weeks; bank drafts still malfunctioned for most autopay customers July 24. The city was not paying a ransom or communicating with the attackers and hired a server-data-recovery specialist.
Reporting on the mayor’s July 24 letter described data removal and corruption, interrupted utility billing and bank drafts, and phased infrastructure replacement. Critical control systems were unaffected, with recovery expected within 45 days.
Mark43 announced deployment of police records, mobile and analytics tools after a cyberattack. Chief Dustin Carter described lost field reporting because the legacy records system could not connect to county dispatch software; officers had to return to headquarters to complete reports.
The newspaper reported a cloud records-platform deployment following a cyberattack that disrupted some police department operations. Chief Dustin Carter said legacy records software could not connect with county dispatch software, requiring headquarters visits to complete reports; the new system enabled field reporting.
Cybernews reported INC Ransom’s Thomasville listing and an alleged 260 GB theft, with purported financial and city-planning samples. That volume differs from Comparitech’s reported 250 GB. Neither report independently authenticates the quantity or the samples.
Signed-in members can report an error, update, or missing source.
