Matagorda County cyberattack disrupts services

Analyst assessment

A cyberattack disrupted Matagorda County’s internal computer systems and government services beginning Jan. 24, 2025. The county’s public update described malicious software, unauthorized network entry and isolation of affected equipment. County Judge Bobby Seiferman issued a disaster declaration Jan. 24 and raised the Emergency Operations Center to increased readiness.

Operational significance

The incident affected several internal systems and departments. By Jan. 26, officials reported progress restoring some online services, but in-person tax payments were unavailable. Residents could use two drop boxes at the tax office in Bay City or mail checks, with timely postmarked payments accepted without penalty. The county explicitly said 911, law-enforcement and radio communications, EMS and volunteer fire communications continued operating.

A Jan. 31 county update said most employees could access email on portable devices and that in-person tax payments were available until 5 p.m. that day. Hardware and software recovery and a forensic audit continued.

A later county attorney’s filing with the Texas attorney general described continuing loss of document and server access and only gradual recovery. The attorney submitted it using a hotspot and said there was no estimated completion time. Its Feb. 5–11 public-information suspension dates are administrative dates, not evidence that systems were restored Feb. 11.

By March 5, all essential county functions were running, but officials were still installing computers, reconnecting equipment and clearing backlogs. They estimated another two weeks for complete system restoration. That forecast is not proof that recovery finished on schedule.

Confidence and uncertainty

Confidence in the cyberattack and material disruption is high because county officials acknowledged both and subsequently documented continuing access problems. The initial statement reproduced in the Palacios Beacon said there was then no indication that residents’ personal information had been compromised. That preliminary finding does not establish a completed forensic determination or exclude every type of data impact.

The Bay City Tribune’s updated report attributed file encryption and locking on some county computers to ransomware, citing officials. Ransomware confidence is moderate because that local report is more specific than the directly reviewed county statement, which described a virus and an investigation without naming a malware family. No responsible group or ransom demand has been independently verified.

Analytic gaps

The initial entry technique, any data theft, ransom or payment outcome and exact final restoration date remain unknown. The March 5 official update documents remaining restoration work and backlogs; no later verified statement establishes when all systems were fully restored. Operational status is presumed resolved based on elapsed time, without assigning an unsupported date for full recovery.