Analyst assessment
Ransomware disrupted Clay County, Indiana, government systems in July 2024. Officials first reported unauthorized activity shortly after midnight July 9. A July 11 county emergency declaration explicitly identified a criminal ransomware attack and said the courthouse, probation and community corrections could not provide critical services. The cyber incident and ransomware characterization are confirmed. The initial access method and responsible operators remain unverified.
Operational significance
According to the county’s statement reproduced by WTWO/WAWV, officials could not access data or connect electronically with some state partners. Courthouse offices and the Health Department closed at 2 p.m. July 9. People with court appearances were instructed to seek rescheduling.
The Highway Department, Extension Office and WIC office remained open. Sheriff’s operations and the dispatch center continued, and 911 telephone service was never affected. An initial disruption to non-emergency telephone lines had been resolved by the county’s early update. This was not a countywide failure of emergency calling.
Officials isolated systems, engaged cybersecurity specialists and notified law enforcement. They later said internet access had been restricted and Mandiant retained to assist the investigation and recovery. A state-hosted website provided an alternate information channel while the original county website was unavailable.
The Record’s July 11 report described continuing closures and a local disaster declaration. The declaration’s seven-day duration was an emergency-authority period, not an estimate or confirmation of full restoration.
Comparitech’s July 19 update reported an extension of the emergency through July 25 and multiple offices still closed. A planned July 22 treasurer reopening was a forecast. Indiana Public Media’s July 19 report also said Clay County still lacked web services.
Later records document equipment damage and gaps in historical data. In September 3 council minutes, Superior Court Judge Bob Pell requested $17,000 to replace the court’s recording system, which he said the cyberattack had damaged. The council approved the appropriation. The minutes do not establish when a replacement was installed or how long recording services were unavailable.
The county substance-abuse council’s 2025 community plan says courthouse, probation and law-enforcement data were limited or unavailable because of the malware attack. This describes a data-access limitation for community planning, with no evidence that all law-enforcement operations stopped. The plan inconsistently refers to June and July 2024 and does not date the data-access observation.
July 9 is the county’s reported attack and detection date; the precise first intrusion is unknown. July 19 is the latest precisely dated observation of continuing service impairment in the reviewed evidence. Later replacement funding and undated data limitations do not establish a precise operational end. The incident is presumed resolved based on its age and the reviewed recovery evidence; no exact full-restoration date is established.
Confidence and uncertainty
Comparitech reported that LockBit claimed the county July 18, alleging 103 GB of stolen data and an August 4 deadline. A ransomware.live lead naming claycountyin.gov records discovery July 19. That domain appears in the Indiana county’s official staff email addresses, but the lead’s descriptive text incorrectly discusses Clay County, Florida. The erroneous description is not adopted.
These records support a qualified LockBit allegation, not independent proof of responsibility, theft, authentic stolen samples or public release of county data. The initial official statement that no personal-data compromise was evident was provisional. BlackSuit references in reporting about neighboring Monroe County are not attribution evidence for Clay County.
Analytic gaps
The precise first intrusion and full-restoration date remain unknown. Data unavailability is documented, while encryption details, affected-person counts, a ransom amount and payment remain unverified.
