A May 5, 2025 ransomware incident disrupted Liberty Township’s email and administrative work while its office and emergency services remained open. The township later confirmed network recovery and notified about 600 people of possible personal-information compromise. SafePay’s responsibility remains an attributed claim.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Unauthorized access to systems, accounts, networks, or data.
Theft, exposure, or abuse of user or administrator credentials.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Stolen, exposed, or otherwise compromised data was publicly released, posted, distributed, or offered for download.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Services or systems experienced recurring, unstable, or temporary periods of unavailability.
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Services continued but with longer processing, response, delivery, or completion times.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.
Liberty Township in Butler County, Ohio, experienced a ransomware incident in the early hours of May 5, 2025, disrupting township email and some administrative work. We reported the email outage, and the township’s public notice confirmed that email was offline and replies would be delayed. Administrator Caroline McKinney later confirmed ransomware and network recovery to DataBreaches.Net. Those acknowledgments support high confidence in both the cyber incident and ransomware involvement.
The township kept its office open and directed residents to use working telephone services while email was unavailable. Its official notice said the website, fire services and police services were unaffected. The sheriff’s substation used a separate IT system, according to local reporting reproduced by National Cyber Security Consulting.
That report also described a brief period of unreliable app-based phone service and delays in issuing permits, while noting that communications and planning portals were operating by the time of the report. These were limited administrative effects; the evidence does not establish an emergency-response outage or township-wide closure.
By June 24, McKinney said the township had recovered its network and changed passwords across the organization. The operational incident is resolved, but the reviewed evidence does not establish the exact final restoration day. Continued investigation and later notifications do not indicate that the original email outage continued.
SafePay’s matching domain listing was discovered June 14. Comparitech’s June 16 coverage and DataBreaches.Net reported the group’s claim that it stole 48 GB. DataBreaches.Net described examining purportedly leaked files containing plaintext credentials. That reporting supports a data-compromise assessment, but the claimed volume and SafePay’s responsibility remain less certain than the township’s ransomware acknowledgment.
A Sept. 1 report, quoting McKinney, said about 600 people, mostly employees, had been sent notices the previous month about potentially compromised personal information and offered a year of monitoring. This later finding is distinct from the township’s initial statement that it had no indication the public’s personal information was compromised. The reported notification count is not a count of residents who lost services.
The initial access route, vulnerability, extent of encryption, ransom demand and payment outcome remain unverified. The reviewed sources do not establish which information categories affected each person or independently confirm the full alleged theft volume. The exact publication time of the original social notice and the final recovery day are also unknown.
SafePay listed the township’s exact domain, alleging 48 GB of theft. DataBreaches.Net and Comparitech reported the matching claim; DataBreaches described examining purportedly leaked credentials. The administrator confirmed ransomware and recovered network, but the reviewed victim statements do not confirm SafePay’s identity or the claimed volume. June 14 is the lead discovery date, not the attack date or verified publication timestamp.
The township government’s geographic remit. Email and administrative work were affected; office, website, fire and police services remained available. This does not establish an outage at every address.
Physical place of the affected township administration at 5021 Winners Circle Drive. The public office remained open and the sheriff’s separately networked substation was unaffected.
Signed-in members can report an error, update, or missing source.
