City of York ransomware incident

Analyst assessment

DysruptionHub assesses with high confidence that the City of York, Pennsylvania, experienced a ransomware incident beginning July 8, 2025. A York Daily Record investigation reported that then-Mayor Michael Helfrich said attackers seized control of the city’s IT infrastructure, disabled email and parking kiosks, and demanded $1 million. The city’s insurer reportedly negotiated the demand to $500,000 and paid it, while York paid a $25,000 deductible.

The city’s Notice of Data Event independently confirms malicious access. York said an unknown actor accessed portions of its network July 8, 2025, and accessed or acquired certain files. That notice establishes unauthorized activity and a data impact, although it does not identify the ransomware family, initial access vector or responsible actor.

Operational significance

The incident materially disrupted municipal operations. Our April 17 report documented that city email was unavailable for about two weeks, digital kiosks at York’s three parking garages were disabled for about three weeks, and staff collected parking payments manually at posted flat rates. Helfrich also said employees lacked normal access to computers and email, while the incident delayed work on city audits that were already years behind.

Parking service was restored Aug. 11, according to the later reporting. Helfrich said the broader matter was not fully resolved until around September. Those statements support a resolved operational status, but the public record does not provide a precise final restoration date or a technical all-clear covering every affected system.

Disclosure posture

The city did not publicly characterize the incident as ransomware while the disruption was underway. An August 2025 report documented the parking interruption and manual payment process, but Helfrich declined to say whether a security breach caused it. Our reporting later found that internal city communications urged control over how details were shared and that a planned July 15 news conference was postponed during ransomware negotiations.

York’s official record evolved over time. The city’s February 17, 2026, council minutes recorded references to a cyberattack on city infrastructure and public calls for transparency. The June data-event notice then confirmed unauthorized network access and file acquisition but did not address the ransom demand or payment.

Retrospective note

York’s data notice confirms that files were accessed or acquired. It lists potentially involved information categories including names, Social Security numbers, dates of birth, driver’s-license numbers, financial account information, taxpayer identification numbers, medical information and health-insurance information. The notice does not state how many people were affected, which categories applied to any particular person or whether the acquired files were used or publicly released.

Confidence and uncertainty

Confidence is high that malicious cyber activity caused the disruption because York confirmed unauthorized network access and inaccessible systems, and the former mayor described the event as ransomware. Confidence is also high that a ransom demand and insurance-backed payment occurred, based on the York Daily Record’s account of the former mayor’s statements and records obtained through a public-records request.

Threat-actor attribution remains unresolved. An internal update reportedly described the attackers as a known Russian group, but York has not publicly named an actor and no public extortion-site claim has been identified. Data access or acquisition is confirmed by the city, while the full exfiltration scope, affected population and any subsequent disclosure or misuse remain unestablished.

Analytic gaps

The public record does not establish the initial access vector, exploited vulnerability, compromised account or host, dwell time, ransomware family, encryption scope, lateral movement, persistence method, recovery architecture or whether the payment produced a functional decryptor. It also does not identify the responsible actor, explain whether law enforcement attributed the incident, or provide a final incident report.

York has not published the number of affected people, the exact files acquired, the data categories applicable to each person, or evidence of public release or misuse. The exact date on which every city system returned to normal also remains unclear.