Analyst assessment
The East Baton Rouge Sheriff’s Office in Louisiana detected a network intrusion on March 29, 2024, and temporarily disconnected potentially compromised computers. In its April 2 statement reproduced by WAFB, the agency said investigators believed its security software had limited the intrusion and that public services remained operational. March 29 is the detection date; the initial access date is unknown.
Medusa claimed the agency as a victim and demanded $300,000 to prevent disclosure of allegedly stolen records, according to WBRZ’s April 3 reporting. The claim included an alleged 92.2 gigabytes of data. The claim establishes extortion activity, but does not establish that systems were encrypted.
In an August 4, 2025 investigation, Straight Arrow News reported examining more than 65,000 files obtained through the nonprofit DDoSecrets. Its findings included sensitive investigative and confidential-informant records, supporting a broader data exposure than the agency’s initial account of folder screenshots and video stills. This retrospective reporting does not establish that operational disruption continued into 2025.
Operational significance
The documented availability impact was a protective restriction of network access for potentially compromised computers. The agency did not identify their functions, the number of affected users or the restriction’s duration. Its warning that security upgrades might interrupt telephone and internet service described possible future effects, not confirmed outages.
The Advocate, in reporting syndicated by Government Technology, observed that the public inmate roster did not appear to function on April 2 while most of the website worked. The cause of that failure was not established. The public record does not demonstrate disrupted dispatch, emergency response, jail booking or prison control systems.
Confidence and uncertainty
Confidence is high that a malicious intrusion and limited network restriction occurred because the agency explicitly acknowledged both. The scale of operational disruption is less certain. Medusa attribution has medium confidence: contemporaneous reporting documented its claim, and Straight Arrow News linked the leaked collection to Medusa through DDoSecrets, but no public agency forensic attribution establishes responsibility. The evidence supports data extortion; ransomware encryption remains unconfirmed.
Operational effects are presumed ended because no later evidence establishes a continuing network restriction. The April 2 statement that public services were functioning does not establish when every isolated computer was reconnected. The public record provides no defensible final restoration date.
Analytic gaps
The initial access route, compromised hosts, duration of internal network restrictions and complete restoration timeline remain unknown. The connection between the inmate-roster failure and the intrusion, any encryption, the full data-theft scope and whether a ransom was paid are also unresolved.
