Derby police data disruption and suspected cyberattack

Analyst assessment

Derby Police Department in Connecticut experienced data-access problems in March 2025 amid credible reporting of a suspected cyberattack. The Valley Independent Sentinel reported March 18 that Chief Scott Todd had described difficulty accessing data at a March 11 tax board meeting. The newspaper cited four unnamed sources who suspected ransomware, while officials had not publicly confirmed the cause.

City officials discussed police IT security in a closed session March 13. That discussion supports concern about the systems but does not independently establish malicious access, encryption or a ransom demand. The incident remains assessed as suspected cyber activity, with medium confidence.

Operational significance

The supported operational effect is impaired access to police data. The available account does not identify the affected application or records inventory, or establish interruption of emergency dispatch, patrol response or public telephone services. Detailed reporting about compromised email, payroll and personnel files concerned a separate 2018 attack and is excluded from this incident’s impact assessment.

In his April 10 report to aldermen and alderwomen, Todd thanked city officials for helping get the department back into operation. He also said work on permanent solutions to the recent IT problems continued, including improvements to the system architecture.

Confidence and uncertainty

The chief’s report supports restored operations by April 10, so the incident is assessed as resolved. The exact restoration date is unverified; the draft’s former April 6 end date was unsupported. March 11 is the earliest dated operational problem established in the located reporting, rather than a verified intrusion date.

March 18 is the earliest located published cyber-specific report. The available official statements acknowledge operational IT problems without confirming a cyber cause. Ransomware remains a reported suspicion, and the technical mechanism is unknown.

Analytic gaps

No verified entry route, encryption evidence, data theft, affected-person count, attacker identity, ransom demand or payment was located. Searches of the department’s name, alias and relevant domains returned no matching ransomware claims. Bounded checks of its public social account did not locate a 2025 cyber acknowledgment. The city’s meeting archive did not expose the original March meeting records during this review, limiting verification of that earlier chronology.