Claim details
LockBit listed Wichita; tracker discovered the post May 7, 2024. This claim does not independently establish official attribution, entry method or stolen-data scope.
City of Wichita ransomware attack
Summary
An early May 2024 ransomware attack interrupted Wichita’s billing, payments and other city systems. Services returned in stages, with some library functions still offline June 17. The city confirmed copied files but could not verify LockBit’s identity.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
-
Vulnerability exploitation
Exploitation of a software or hardware vulnerability to gain unauthorized access or execute malicious actions.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data theft or exfiltration
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
-
Data encryption
Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Website unavailable
A public-facing website was unavailable, disabled, or inaccessible.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Transaction processing disruption
Business, financial, customer, administrative, or operational transactions could not be completed normally.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
Extortion indicators
-
Encryption-based extortion
The extortion activity involved unauthorized encryption of systems or data, with restoration or decryption conditioned on payment.
-
Leak-site listing
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
-
Payment denied
An authoritative source stated that no ransom or extortion payment was made.
Incident narrative
Analyst assessment
Wichita, Kansas, disconnected city systems after identifying an external intrusion early May 5, 2024. The city later said staff first noticed unusual activity May 4, while its data-event notice documented unauthorized copying of files between May 3 and 4. Confirmed encryption and protective isolation caused municipal service disruption.
Operational significance
Billing, payment processing and other city applications were impaired. First responders continued operating, and the reviewed evidence does not establish interrupted drinking-water treatment or delivery. A May 29 city update reported recreation registration and payment functions returning. By June 10, water accounts and payment services were returning, but delayed processing left some bills covering more than 60 days.
The June 17 update reported airport information screens and most library functions restored. Library self-check-in and credit-card processing at the Advanced Learning Library remained offline. KWCH reported Sept. 18 that all city systems were back online. The incident is presumed resolved; the report establishes restoration by that date, without identifying the exact day the last affected service returned.
Confidence and uncertainty
The city’s later wrap-up identified a vulnerability in an unnamed third-party appliance, acknowledged access to police records potentially involving up to 77,000 cases, and said no ransom was paid or directly requested. The number of cases is not a count of affected people. The earlier notice confirmed copying of law-enforcement files containing personal information. The city expected insurance to cover technology and professional-service recovery costs after a $250,000 deductible; that amount is not a total recovery-cost estimate.
LockBit claimed responsibility, but the city said it could not verify the group’s identity. KMUW reporting on May 8 described a purported May 15 deadline for payment to prevent publication of data. This reported public threat is distinct from the city’s statement that it received no direct ransom request. Neither the tracker listing nor reporting on charges against a LockBit administrator independently verifies who conducted the Wichita intrusion.
Analytic gaps
The appliance, vulnerability identifier, complete inventory of copied files, affected-person count, total recovery cost and final restoration date remain unverified. The September investigation update does not establish that operational disruption continued until September.
Threat actor and claim
Organizations involved
City of Wichita
Location
Organization type
Critical infrastructure
Impacted location
Wichita, Kansas
Municipal service jurisdiction for the affected city. Billing and other systems were disrupted; drinking-water delivery and emergency response were not shown to have stopped.
Wichita anchors the affected city government’s operations; specific availability effects are described in the report.
Sources
Wichita disclosed encryption malware and said some services were inaccessible. Police and fire continued serving residents, while systems were checked before a staggered return.
The report described municipal service disruption while quoting the city that water systems remained secure and operational. Water-account billing was affected, and cash payments remained available.
KMUW reported a purported LockBit deadline of May 15 for payment to prevent publication of Wichita data. Municipal payments remained limited to cash or checks, and the city had not provided a restoration timetable.
Recreation registration, in-person credit-card processing and golf payments had returned. Water billing and other systems were still being restored, with systems tested before reopening.
Water accounts and payments were returning, with some bills covering more than 60 days because processing was delayed. Library account and catalog tools and airport information displays remained unavailable.
Airport information screens and most library services had returned. Self-check-in and credit-card processing at the Advanced Learning Library remained offline while remaining issues were repaired.
KWCH reported that all city systems were back online. City Manager Robert Layton said the city had no contact with the attackers, paid no ransom and expected a $250,000 deductible, with remaining recovery costs covered by insurance.
The city confirmed files copied without permission between May 3 and 4, including law-enforcement and traffic records containing names, Social Security numbers, identification numbers and payment-card information.
The tracker lists wichita.gov under LockBit3. This records an attribution claim, without independently verifying the attacker or complete stolen-data scope.
The city described access through an appliance vulnerability, police records potentially involving 77,000 cases, no direct ransom request and no payment. It expected insurance to cover recovery costs after a $250,000 deductible.
See something that needs correction?
Signed-in members can report an error, update, or missing source.