DuPage County court and sheriff ransomware attack

Analyst assessment

DuPage County officials identified a cyber incident around 2:30 a.m. April 28, 2025, and confirmed ransomware that evening. The affected organizations were the sheriff’s office, the 18th Judicial Circuit Court and the circuit court clerk’s office in Wheaton, Illinois. Their joint statements support a confirmed cyberattack assessment with high confidence.

Operational significance

Affected systems were taken offline. Chancery sales were canceled for the week, while in-person proceedings continued with limited disruption. Officials initially said jail operations, public safety and other county operations were unaffected.

The court’s May 7 statement instructed litigants, jurors and other participants to appear as scheduled. That assurance concerned access to proceedings and did not establish that every information system had recovered.

In a June 9 recovery announcement, court leaders said all court systems and services had been restored just over three weeks after the initial disruption. E-filing, orders of protection, electronic orders and remote proceedings were fully operational. The announcement establishes court recovery but supplies no exact restoration date and does not independently date recovery of sheriff’s office IT.

The County Board ratified an emergency mitigation contract May 13 with Coalition Incident Response, capped at $54,900. That ceiling is an authorized contract amount, not verified spending, total incident loss or a ransom payment.

Later county procurement records documented a jail HVAC malfunction caused by the cyber incident and associated repair services. They do not establish its duration, effects on detainees or a suspension of custodial operations. This qualifies the initial assurance without demonstrating that jail services stopped.

On Sept. 23, the board approved a total contract ceiling of $500,000 for response-related goods and services. It was an authorization, not a verified paid total or ransom. The earlier $54,900 contract should not be added to that ceiling as a separate confirmed loss.

Confidence and uncertainty

Ransomware confidence is high because elected officials explicitly confirmed it. The reviewed evidence does not establish a responsible group, initial access method, ransom payment or independently verified file theft. DysruptionHub’s contemporaneous report described a ransom note and stolen files based on external reporting; those assertions have not been independently corroborated here. Procurement of data-mining and breach-notification legal services does not itself establish file theft.

The historical operational status is presumed resolved. Court recovery is affirmatively documented, but the reviewed sources do not establish a universal recovery day across all three affected organizations. April 28 is the documented discovery and disruption date; an exact endpoint remains unverified.

Analytic gaps

An exact sheriff IT recovery date, the extent of any data compromise and final response costs remain unverified. Continued in-person hearings and initial assurances about jail continuity do not negate the documented disruption to court and sheriff information systems.