Ransomware disrupts Grand Traverse County and Traverse City

Analyst assessment

Grand Traverse County and Traverse City, Michigan, took their shared office network offline after detecting irregularities June 12, 2024. The city’s initial notice said county staff recognized the problem at 6:06 a.m. and subsequently identified ransomware. That is a detection and containment sequence, not a verified initial intrusion time. The county managed the network for both governments.

The county administrator told The Ticker that ransom demands appeared in “Read Me” emails and files. He said staff had not followed the supplied links. Officials initially reported no evidence of a mass transfer of information, while acknowledging that the confidentiality investigation remained incomplete. Our June 13 report drew on that local reporting.

Operational significance

The shutdown disrupted employee connectivity, government records, selected payments and court proceedings. Staff used mobile connections and alternative processes while computers were evaluated before reconnection. Some court dockets were canceled while other proceedings and filing channels continued. Initially available third-party payment services did not remain uniformly available: June 25 reporting described precautionary suspensions of selected water, sewer, tax and BS&A-integrated payments.

Emergency calls and first-responder radio communications continued. That continuity did not mean dispatch technology was unaffected. In the county dispatch center’s 2024 annual report, Director Jason Torrey said critical supporting systems were compromised and staff lost tools that normally made dispatch more efficient. Employees implemented backup procedures and improvised further workarounds.

A June 27 Record-Eagle report republished by Firehouse said computer-aided dispatch became operational June 25, although bugs remained. Officials estimated that about 80% of county infrastructure was back online, with document-management and other applications still requiring work. These are partial restoration milestones.

The city’s service-impact page says roughly half of water and sewer customers missed June billing and would receive June and July bills together, without late fees. It also lists restored services alongside phone-service gaps. The page was updated over time; its June 14 heading does not date every listed condition. The incident is assessed as presumed resolved, with June 27 providing dated evidence of incomplete restoration and no exact final recovery date established.

Confidence and uncertainty

Confidence is high in ransomware involvement and the shared-network disruption because an affected government explicitly acknowledged both. The dispatch center’s own account confirms loss of supporting tools while explaining how emergency response continued. Traverse City Light & Power used a separate network and was reported unaffected.

An October 2025 report said the county notified 782 people and quoted its notice describing personal information in compromised network locations. It identified names and Social Security numbers. This later notification qualifies the early assurance about an absence of observed mass transfer; it does not establish a public leak or provide a verified theft volume. Notification activity also does not extend the operational outage into 2025.

In The Ticker’s June 25 report, County Administrator Nate Alger said the attackers used the BlackSuit name while their identity remained unknown. This supports qualified attribution with medium confidence; it does not authenticate a group-controlled victim listing or independently establish the operators’ identity. Alger also said the county had not paid a ransom as of that report, which does not resolve every later financial action. The separate April 2024 Traverse City Area Public Schools incident and its Medusa claim do not identify the perpetrators here. The city’s November 2024 move toward separating IT services concerns governance after the attack, rather than proof of continuing outages.

Analytic gaps

The initial access method, precise intrusion window, full scope of copied information, encrypted systems, ransom amount and payment outcome remain unresolved. The complete county and city notification records need further review to distinguish their affected populations and findings. A dated final recovery statement is also needed; later changes to an evolving service page cannot supply an exact historical restoration date.