Gadsden County Sheriff’s Office cybersecurity incident

Analyst assessment

The Gadsden County fiscal year 2025 audit says a December 2025 cybersecurity incident compromised part of the Gadsden County Sheriff’s Office information technology infrastructure. The sheriff’s office worked with law-enforcement agencies and specialized recovery consultants to recover compromised data and restore affected operational systems. The audit also says several financial reports and supporting schedules were lost or deleted and could not be retrieved or recreated. DysruptionHub assesses this as a confirmed cyber incident with high confidence; the public record does not identify the attack mechanism.

Operational significance

The sheriff’s accounting records were not ready for audit until June 2026, about nine months after the fiscal year ended, and some supporting documents remained unavailable. WCTV reported that the sheriff’s delay contributed to Gadsden County filing its annual audit two months after the state deadline. The audit attributes the delay to both the cyber incident and insufficient accounting staffing, so the full delay cannot be assigned to the cyber event alone.

The audit identified incomplete and irregular backup and recovery processes and recommended a comprehensive recovery plan for financial records, stronger monthly reconciliation procedures and consideration of a cloud-based accounting system.

Confidence and uncertainty

Confidence is high that the incident compromised sheriff’s office infrastructure, affected operational systems and disrupted financial-record processing because the official audit documents those effects and includes the sheriff’s management response. The record establishes availability and recovery impacts, but it does not establish unauthorized disclosure or theft of data.

A September 24 Gadsden County Times report calls the event ransomware; the publisher’s accessible homepage teaser says the office was locked out of its computers for more than a month. The full article is subscriber-only and its attribution and technical basis could not be reviewed. Ransomware and the reported lockout duration therefore remain unconfirmed. The reviewed official audit and WCTV report do not identify an extortion demand, a threat actor, the initial access vector, a malware family or the full set of affected systems. The available evidence also does not establish disruption to 911, dispatch, detention, patrol or other public-safety services.

Disclosure posture

The county audit, dated Sept. 3, 2026, is the first located public cyber disclosure. The sheriff’s office concurred with the audit recommendation and said staffing limitations and the incident contributed to the delayed financial close. WCTV reported on Sept. 16 that the sheriff’s office declined an interview because the investigation remained active.

Current status

The incident is presumed resolved operationally. The accounting records were ready for audit by June 2026 and the audit was completed in September, but no final technical restoration notice or all-clear has been published. The continuing investigation does not, by itself, establish continuing operational disruption.

Analytic gaps

The exact December 2025 incident date, duration of system outages, affected equipment and software, scope of compromised data, backup status, remediation and replacement costs, recovery milestones and any effect on public-safety operations remain unknown.