Analyst assessment
Hamilton County Sheriff’s Office in Tennessee detected an unauthorized external access attempt around 6:30 a.m. April 14, 2025, and shut down its systems. The agency’s initial statement, reproduced by East Ridge News Online, said the response disabled its website and several public tools while law enforcement and corrections continued under continuity procedures. The sheriff subsequently identified a ransomware event. These direct acknowledgments and documented service effects support a confirmed cyberattack assessment with high confidence.
The sheriff’s May 2 final update established that the remaining internal software connecting the office with local and state agencies was fully restored May 1. The incident is therefore resolved on a positively documented restoration date.
Operational significance
The initial shutdown made mugshots, press releases, warrant searches, the tip line and some app functions unavailable. The office’s recovery timeline records agency email becoming operational April 23 and a phased return of systems April 23–30. An April 29 statement said all public programs were functioning, while some internal software remained offline. The documented effects concern digital services, records access and staff work; the evidence does not establish a jail closure or interruption of patrol operations.
Sheriff Austin Garrett said the attackers demanded $300,000 and that the office did not consider paying it. He reported a $48,000 expense for Vendetta, the outside cybersecurity firm. That figure excludes unquantified productivity losses and public inconvenience and should not be treated as the total incident cost. Backups enabled recovery to an April 13 state; that restoration point does not establish an April 13 intrusion.
Confidence and uncertainty
A Vendetta Cyber Defense attestation, dated April 29 and publicly released with the May 2 update, reported containment, eradication and no identified evidence of unauthorized alteration, exfiltration or destruction of protected or sensitive information in its post-incident review. Its second page limits the assessment to the work performed and information available. This is a bounded vendor finding, not proof that no information could have been taken.
A Qilin-attributed tracker listing identifies the office’s domain and was discovered May 8. Comparitech reported the allegation, while noting the office had not verified the group’s claim. Qilin’s responsibility is recorded with low confidence. The later listing does not itself establish data theft, encryption, a ransom payment or renewed operational disruption.
Analytic gaps
The public evidence does not establish the initial access method, a specific malware family, the amount or categories of any stolen information, or the full cost of recovery. April 30 is the last documented day in the phased restoration period, followed by the sheriff’s May 1 full-operations date. The later claim does not extend that operational timeline.
The Chattanooga administrative headquarters provides the physical location anchor. Hamilton County represents the sheriff’s geographic remit, without implying a countywide outage or that every municipal police service was affected. This April 2025 sheriff’s office event is distinct from the county government’s separate 2024 breach and subsequent notifications.
