DeKalb County
DeKalb County, Indiana cyber incident disrupts government systems
Summary
A September 2025 cyber incident disrupted DeKalb County, Indiana, computer and phone services, with administrative effects documented into October. A March 2026 notice said personal information may have been copied; ransomware and a full recovery date remain unconfirmed.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Authentication disruption
Users were unable to authenticate, sign in, access accounts, or use identity-dependent services.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
DeKalb County, Indiana, experienced a confirmed cyber incident that prevented staff from signing into workstations and disrupted county computer and phone services in September 2025. The county’s Sept. 29 update establishes the cyber cause and operational effects; the initial access method remains unknown.
We reported Sept. 30, 2025, that recovery was continuing after discovery Sept. 25. A later county notice dated March 6, 2026, said information may have been copied between Aug. 21 and Sept. 25, 2025. That possible access window does not establish when the service disruption began.
Operational significance
The county brought in outside contractors and notified law enforcement while restoring computers and phones. Its Sept. 29 statement said emergency dispatch continued functioning, so the disruption should not be described as a 911 outage.
The Oct. 7 planning minutes in the November meeting packet show effects beyond employee logins: staff had limited access, an aerial map was unavailable because of access to geographic information systems, and a proposed plat could not be recorded until the cyber incident was resolved and a separate zoning variance was approved. These records establish an administrative interruption extending into October, without proving that every county service was unavailable.
Confidence and uncertainty
Confidence is high that the cyber incident materially disrupted county operations because the affected government documented both. The March notice identifies potentially affected personal information but uses conditional language about copying; actual exfiltration, encryption, ransomware involvement and a responsible actor are not established.
Analytic gaps
The reviewed public evidence does not establish the entry point, number of affected workstations, full cost, ransom demand or payment. Name, official-domain and commissioner-name ransomware searches produced no matching lead. The social post embedded in our original report could not be independently retrieved during this review; the county’s accessible documents support the core findings.
Operational status
The latest specific operational-impact observation located is Oct. 7, 2025. No authoritative restoration date was found through Oct. 23, 2026, so operations are presumed resolved based on elapsed time. The March 2026 data notice does not show continuing operational disruption or establish a recovery date.
Organizations involved
Impacted locations
Auburn, Indiana
Municipality anchor for affected county government offices in Auburn; does not designate City of Auburn government as a victim.
DeKalb County, Indiana
County government computer and phone interruption affected county administration. County boundary denotes governmental service jurisdiction, not a claim every resident or facility experienced an outage.
Sources
We reported disruption to county systems after the Sept. 25 discovery, with emergency dispatch continuing and recovery ongoing.
County staff could not access workstations, and computer and phone restoration continued. Emergency dispatch remained operational.
The county said information may have been copied during an August–September 2025 interval and offered credit monitoring.
October meeting minutes describe limited access, unavailable GIS mapping and a recording dependency on cyber incident resolution.
See something that needs correction?
Signed-in members can report an error, update, or missing source.