City of Winston-Salem
Winston-Salem cyberattack disrupts payments and city services
Summary
Winston-Salem took systems offline after detecting an intrusion on Dec. 26, 2024. Online payments and CityLink calls were disrupted, with services restored in stages.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Data theft or exfiltration
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Transaction processing disruption
Business, financial, customer, administrative, or operational transactions could not be completed normally.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Customer or public access restricted
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
Extortion indicators
-
No known extortion indicator
Available evidence indicates that no extortion demand, threat, communication, or related pressure tactic was identified.
Incident narrative
What happened
Winston-Salem, North Carolina, detected a network intrusion on Dec. 26, 2024, and took computer systems offline as a precaution. The city’s Dec. 30 announcement described disrupted network operations and disabled online payments. Residents could pay in person with cash or checks, while utility delivery and police and fire responses continued.
WFDD reported on Jan. 7 that CityLink telephone service was also unavailable. Residents could still submit requests by online chat or text. On Jan. 17, City Manager Patrick Pate said major systems had been rebuilt, but public interfaces remained unavailable while security checks continued.
The city restored online payments on Feb. 11 for utilities, plan review fees, parking tickets and BuildIT permits and inspections. Account balances still covered bills through Dec. 23; billing was scheduled to resume the week of Feb. 17. By late February, the mayor said public-facing services were available again.
Operational significance
The intrusion interrupted routine transactions and residents’ access to municipal services even as emergency response and utility delivery continued. In-person payments, chat and text provided alternatives. The mayor also described payroll and contractor workarounds.
The recovery was phased: rebuilding internal systems did not immediately restore public access, payment processing or the billing cycle. The evidence does not establish one continuous outage affecting every city function.
Confidence and uncertainty
Named city officials and contemporaneous reporting establish a malicious intrusion with operational consequences. The early statement that no personal-data exposure had been found reflected the investigation at that time. In February 2026, WXII reported the city’s finding that an attacker copied information.
The reviewed evidence does not identify a responsible group or establish a ransom payment.
Analytic gaps
The initial access route, earlier intrusion period, exact final restoration date, copied data categories and affected population remain unresolved. Available reporting does not establish whether files were encrypted or ransomware was used. The municipal incident was separate from the PowerSchool breach affecting local schools.
Organizations involved
Impacted location
Winston-Salem, North Carolina
The municipal government’s official Government, City Officials and Departments pages establish Winston-Salem’s municipal service remit. Reuse the existing exact city boundary, OSM180101/admin8; actual CityHall street Census match confirms city3775000 withinForsyth37067. The paired city service-area overlay identifies the affected government’s remit and does not establish interruption of every facility, service or resident. Utilities customers outside city limits do not establish that all ForsythCounty or its county government was affected; any separate utility-service-area model requires its own authority/extent evidence.
Winston-Salem contains the affected municipal government’s City Hall at101NorthMainStreet and administrative offices. The city municipality is the physical anchor; no individual building/facility location or attack entry-point claim. Police/fire response and utility delivery continued while digital transactions and CityLink were disrupted.
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.