Analyst assessment
West Haven, Connecticut, shut down its municipal IT systems after a security alert on Christmas Day 2024. Mayor Dorinda Borer later told the New Haven Register that the city took the systems offline after detecting the breach. The city’s Jan. 11 statement confirms the security incident, outside investigative assistance and contact with authorities.
Operational significance
The shutdown interrupted municipal network, phone and computer systems. In its Dec. 26 public notice, the city acknowledged the network disruption and said 911 remained operational for emergencies. That notice disclosed an outage before the later cyber-specific acknowledgment.
The city said backups allowed all affected systems to become operational within a few days. Borer subsequently described server restoration within four days. These accounts support operational recovery, but they do not establish an exact restoration date. Continuing forensic work in January concerned the investigation and possible data impact; it does not demonstrate that municipal systems remained offline then.
Confidence and uncertainty
Confidence in the cyber incident and shutdown is high because the city acknowledged both. A ransomware tracker lists cityofwesthaven.com under Qilin and records a Jan. 11 observation, with an allegation that data would be released Jan. 19. The listing and deadline are actor allegations, not independent confirmation of attribution, encryption, a completed leak or payment.
Later reporting changed the initial picture of possible data exposure. Comparitech’s Feb. 13 update reported 4,932 affected people and names and Social Security numbers. Vermont’s attorney general also lists a Feb. 12 city consumer notice. The reported number and data categories remain attributed to Comparitech pending verification of the original notification’s contents.
Analytic gaps
The initial access method, any use of file-encrypting malware, ransom demand or payment, and the precise final recovery date remain unresolved. The full regulatory notice is still needed to verify the affected population, data categories and access window. The city’s separate 2018 ransomware incident and payment do not establish the technical cause or financial outcome of the Christmas 2024 incident.
