Skip to content
DysruptionHub
Sign in Subscribe

Franklin County ransomware attack

Summary

Franklin County Government logo

A Feb. 6, 2025, ransomware attack briefly disrupted Franklin County, Maine, computer systems. The county reported restoration within 24 hours using backups and no permanent data loss. Later reporting identified insurance-related expenses; final privacy findings remain unverified.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High
Ransomware:
Confirmed

Attack mechanisms

  • Ransomware

    Malware that encrypts systems or data, typically accompanied by a ransom demand.

Data impacts

  • Unknown data impact

    The incident is cyber-related, but available evidence does not establish whether or how data was affected.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Government services disrupted

    Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.

Extortion indicators

  • Unknown extortion indicators

    The incident may involve extortion, but available evidence does not establish which extortion indicators were present.

Incident narrative

Analyst assessment

Ransomware briefly disrupted Franklin County, Maine, computer systems on Feb. 6, 2025. County Administrator Amy Bernard confirmed the cause in a statement reported by the Sun Journal on Feb. 28. The county said backups enabled its IT staff to restore affected functionality in less than 24 hours, with no permanent data loss.

The county contacted its cyber insurer, involved outside technical specialists and notified law enforcement. A subsequent publication of the county’s statement said the forensic investigation had concluded and recommendations were being implemented, while review of information potentially subject to unauthorized access continued.

Operational significance

The documented consequence was a short interruption of county IT functions. Public accounts do not identify every affected application or establish that emergency response, courts or all county departments stopped operating. The county’s geographic service area identifies its governmental remit; it does not imply a countywide outage for residents.

The financial consequences continued after technical restoration. On July 29, the Sun Journal reported that commissioners reallocated money to cover a $50,000 insurance deductible and $9,681.81 in uncovered expenses. Those figures describe identified county expenses. They do not establish the insurer’s payout, a ransom payment or the total cost of the incident.

Confidence and uncertainty

Named county acknowledgment supports high confidence in ransomware and concrete operational disruption. The county described a completed operational recovery, supporting resolved status. Its less-than-24-hour account does not establish whether restoration finished Feb. 6 or Feb. 7, so no exact end date is assigned.

No permanent data loss is a recovery finding. It does not establish that an intruder could not access or copy information. A later affected-person count appearing in an aggregator could not be verified against the underlying state filing, which required authentication when checked.

Analytic gaps

The initial entry time, entry vector, full affected-system inventory, final privacy findings, independently verified notification count and responsible group remain unverified. Ransomware-lead searches under the county’s name and domain returned no matching claim. Coverage of other Franklin counties, including Washington’s 2024 event, is a separate incident.

Organizations involved

Impacted locations

  • Farmington, Maine

    Farmington is the county seat and physical administrative anchor. Affected county IT nexus; no specific facility closure documented.

    Source

  • Franklin County, Maine

    Paired county government service overlay. Does not assert every department, municipality or resident lost service.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.