Claim details
Qilin listed City of Urbana with the Ohio city’s urbanaohio.com domain. This is a claim, not confirmation of actor responsibility, ransomware deployment or data theft.
City of Urbana Cyberattack
Summary
The City of Urbana said a Nov. 23, 2025, cyberattack disrupted several municipal computer systems. It said police, fire, public works, courts and emergency response continued to operate while technical teams investigated.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Our November 2025 report documented the City of Urbana’s statement that an attack discovered Nov. 23 disrupted municipal computer systems. City IT staff worked with state and federal cybersecurity partners to contain and investigate it. The affected organization used cyber-specific language, supporting a confirmed cyber assessment.
Operational significance
Officials did not specify the affected systems, but several municipal computer services were disrupted. Police, fire, public works, courts and emergency response continued to operate. A disruption in back-office systems is supported; a 911 or utility outage is not. The geographic service area identifies the government’s remit; it does not imply every person or facility in that area experienced an outage. The Urbana location is the organization’s physical administrative anchor, not a separate assertion that every facility there was compromised.
Current status
The city said restoration work was underway and promised updates. The last documented disruption is from 2025, and the reviewed material does not establish a comprehensive final restoration statement. Status is therefore presumed resolved unless an authoritative all-clear is verified.
Confidence and uncertainty
The city said it had no evidence that sensitive information was leaked, but that was an interim finding during an ongoing investigation. No reviewed source establishes initial access, complete system scope, confirmed data exfiltration or a named perpetrator. A ransomware.live listing discovered Dec. 3, 2025, records a Qilin claim against the City of Urbana and gives the Ohio city’s urbanaohio.com domain. The city has not confirmed the group’s responsibility, ransomware deployment or data theft, so these remain allegations.
Threat actor and claim
Organizations involved
City of Urbana
Location
Organization type
Critical infrastructure
Impacted location
Sources
The City of Urbana, Ohio, said a Nov. 23 cyberattack disrupted several municipal computer systems but left police, fire, public works, court and emergency response services operating as state and federal cybersecurity teams investigate.
See something that needs correction?
Signed-in members can report an error, update, or missing source.