Analyst assessment
A ransomware attack disrupted the Jefferson County Clerk’s Office in Kentucky in July 2024, closing its eight branches and delaying vehicle transactions, records services and licensing. Branches reopened in stages, while some services remained unavailable after the first locations reopened. Officials later investigated possible exposure of personnel and election-administration information. The incident is presumed resolved; a precise date for restoration of every affected service has not been verified.
Operational significance
The office discovered the attack early on July 22 and announced closures that evening. Its ransomware acknowledgment was reported July 23. Louisville Public Media reported that the interruption delayed vehicle registrations, deed recording and marriage and notary licensing. Clerk Bobbie Holsclaw described the work of cleaning and reconnecting more than 300 computers.
WAVE’s July 26 report documented the Dixie branch reopening that afternoon. The office worked with state technology officials to restore its protected access to the Kentucky Automated Vehicle Information System, or KAVIS. That access restriction does not establish a compromise of the statewide application. Earlier KAVIS-related backlogs and the separate CrowdStrike outage should not be conflated with this attack.
Most branches resumed service July 27, though Highview experienced a temporary interruption and downtown remained closed. By July 29, all eight vehicle branches had reopened, but legal records and marriage licensing remained unavailable. Reopening a branch therefore did not establish complete recovery of the office’s services.
The clerk’s own July 29 notice also said its deed room, professional licensing and delinquent-tax office remained closed and its website was unavailable. Subsequent official replies documented continuing problems: property-tax processing was still down July 31, marriage licensing was unavailable Aug. 1, and delinquent-tax processing remained unavailable Aug. 7. These dated office statements establish residual disruption beyond the reopening of the motor vehicle branches.
The office’s 2024 annual report says its technology team recovered the network and resumed customer services with federal and vendor assistance. Its brief description of a four-day closure does not supply a date when every service returned or resolve the later service-specific restrictions. The report also lists stronger passwords and multifactor authentication for more than 250 employees among its technology accomplishments, without giving an implementation date.
Confidence and uncertainty
In August, the office provided WAVE with a photograph of a ransom note. The note offered decryption in exchange for payment, claimed possession of the office’s data and threatened disclosure. These assertions establish the extortion demand and threats, while the note alone does not independently prove every claimed technical action. The office said it had not contacted the attackers back. At an Aug. 22 legislative hearing, Holsclaw said no ransom was paid and most services had been restored. Her account does not establish an exact date when every service returned.
Early assurances that personal information had not been compromised were subsequently qualified. StateScoop reported Aug. 15 that spokesperson Ashley Tinius said the office was reviewing files to identify people needing notification. Personnel information, Social Security numbers and election-administration material may have been exposed. RansomHub alleged it had taken 47 gigabytes and posted a payment deadline. The claimed volume and the group’s responsibility have not been independently confirmed.
WAVE reported Aug. 14 that a forensic analysis identified compromised credentials and a virtual private network as the means of access. The office said critical cloud-hosted applications were not accessed. Disruption of the clerk’s access to those applications does not establish that the applications themselves were compromised.
In reporting on the Aug. 14 testimony, WDRB quoted Summerfield describing deleted backups, disabled security tools and encryption of shared drives, virtual machine servers and their host computers. He said the office had neither negotiated nor considered a ransom payment. WDRB later reported that Holsclaw said the office did not carry cyber insurance.
In Aug. 14 legislative testimony, Executive Director David Summerfield said intruders had been in the system two days before the July 22 attack. That statement supports an earlier access window without supplying an exact initial-access timestamp. He reported spending just under $100,000 on protection and remediation, which is distinct from a ransom payment. Government affairs official Frank Friday said election security was not compromised. Possible exposure of election-related documents does not establish alteration of voting systems or election results.
Analytic gaps
No reviewed source establishes an exact date when every disrupted service and recovery backlog was cleared. Later reporting about possible data exposure or a ransom claim does not itself show continued operational disruption.
