Delaware County cyberattack disrupts county systems

Analyst assessment

DysruptionHub assesses with high confidence that Delaware County, Pennsylvania, experienced a malicious network intrusion that disrupted government services. The county’s July 2 statement said it identified unauthorized activity June 26 and shut down network access to protect sensitive information and critical systems. A July 10 update characterized the activity as a sophisticated cybercriminal attack and confirmed limited access to the county network and county-maintained data.

County Executive Director Barbara O’Malley later said managed detection alerts identified anomalous network activity June 26 and that forensic investigators determined attackers gained remote access that day. She said investigators found no evidence of phishing or unauthorized access to the county email system and no further unauthorized activity after the county secured its network June 26. The specific remote-access method remains unknown.

Operational significance

Our report documented outages affecting county servers, internet and phone lines. The Sheriff’s Office said its systems were offline and county offices could not make or receive calls. Delaware County Libraries reported that public computers and in-library catalogs were unavailable and asked patrons to bring library cards for checkout.

KYW Newsradio quoted the county communications director saying phone systems, internet access, internal servers and financial software had been down. Departments used alternate procedures, including paper workflows, to maintain services while systems returned in stages.

Disclosure posture

The county publicly described the disruption as a network outage beginning June 26. The Sheriff’s Office later said county IT and communications personnel were working to resolve what it called a `provider disruption`. When we asked July 1 whether the event was being investigated as a cybersecurity incident or whether cybersecurity involvement had been ruled out, the county did not answer that question.

The county acknowledged July 2 that unauthorized activity had disrupted its network and that it deliberately shut down access in response to intrusion attempts. It disclosed July 10 that attackers had gained limited access to the county network and county-maintained data. O’Malley later said managed detection alerts identified anomalous activity June 26 and officials took the network offline that day.

That chronology makes the provider-disruption explanation more than an incomplete early description. It pointed the public toward an external service cause that was inconsistent with the county’s later account of what officials detected and why they shut down the network June 26. The public record does not establish who originated or approved the Sheriff’s Office wording, what information the office had received or whether anyone intended to mislead.

The July 2 disclosure remains the earliest dated concrete public cyber signal. June 26 is the detection and containment date, not the public cyber-evidence date.

Current status

The incident is resolved operationally. In an Aug. 3 statement, the county said it had fully restored operations and used secure backup data to minimize the impact. O’Malley later said the county reset credentials for all network account holders and rebuilt systems and devices from secure, uninfected backups.

The resolved status marks the end of documented service impact, not the end of forensic, legal or data-risk work. The county was still reviewing which data attackers accessed and said it would notify affected people if required by law.

Confidence and uncertainty

Cyber and operational-impact confidence are high because Delaware County directly confirmed remote unauthorized access, defensive shutdown and recovery. Data confidentiality was affected at least at the access level, and data availability was impaired while systems were offline. The county has not said whether information was copied, removed, altered or exposed outside its network.

The public record does not establish ransomware, encryption, an extortion demand, payment or a named threat actor. O’Malley said the county restored its network and data without relying on a decryption key or other outside tools, but that statement does not establish that encryption occurred. The county’s 2020 ransomware incident explains its backup improvements but does not establish the mechanism or attribution of the 2026 intrusion.

Analytic gaps

The public record does not identify the remote-access method, exploited vulnerability, compromised account, malware or tools, attacker dwell time, affected hosts or persistence. The accessed-data categories, any exfiltration, affected-person count, notification obligations and actor attribution also remain unresolved.