An Aug. 25, 2026, ransomware attack disrupted Merrimack County systems, police data access and electronic deed filings. The county said it used backups to restore systems without paying a ransom. The final restoration date and possible personal-data impact remain unresolved, and a Booba Project data-theft claim is unverified.
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Internal or external network connectivity was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Police, fire, emergency medical, corrections, emergency management, or other public-safety operations were materially affected.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
Merrimack County, New Hampshire, experienced a ransomware cyberattack affecting county network systems beginning Aug. 25, 2026. Patch reported that County Administrator Ross Cunningham confirmed the network security incident Aug. 26 and said the county was working with network security and third-party specialists. In an Aug. 27 response, county Development Coordinator Kara Coffey confirmed that the investigation concerned unauthorized activity and said third-party forensic specialists were examining its extent and root cause.
Ransomware.live lists a Booba Project claim naming “The Merrimack County,” linking to the county’s website and alleging that 3 GB of data was stolen. The listing establishes the existence of a public claim, not Booba Project’s responsibility or the alleged data theft. County Administrator Ross Cunningham later confirmed ransomware involvement to the Concord Monitor, independently of that group claim.
The earliest documented effect occurred Aug. 25, when a county dispatcher told officers in several jurisdictions that dispatch could not access criminal data through the state’s IMC software. The system supports access to driving information, criminal records and active warrants. Nearly 20 law enforcement departments rely on county dispatchers, although the county used other departments to obtain information and Concord police were not affected.
By Aug. 26, some county systems had been restored while others remained offline as a precaution. The Register of Deeds still said Sept. 2 that its office was experiencing a network outage and would temporarily accept only paper documents delivered in person or by mail. That limitation disrupted normal processing for deeds, mortgages, liens and other real-estate records and required an in-person or mail workaround.
Coffey said Aug. 27 that certain impacted systems remained offline as a precaution and could limit services. She said Merrimack County Dispatch call taking and emergency responses for the agencies it serves remained fully functional. The incident therefore affected public-safety information access and county property-record processing without interrupting dispatch call taking or emergency response.
On Sept. 15, Register of Deeds Samantha Morse announced that internet service had returned and electronic recording could resume, while warning that electronic submissions could take additional time to process during catch-up work. The post’s updated caption says all paper documents had been scanned and were current online; the time of that edit is not identified. On Sept. 26, the county’s Deeds page no longer displayed the network-outage notice, and its linked Landmark records portal loaded public search options. This establishes restored public access and a departmental recovery update, not verified completion of every county system or every filing transaction.
WMUR reported Sept. 29 that Bow’s police chief described delays in processing copies of police reports and right-to-know requests because of the county incident. The chief said dispatch, emergency services and police operations were unaffected. The report does not date the records-processing delays or establish that they persisted Sept. 29.
Merrimack County first publicly characterized the disruption as a network security incident in comments reported Aug. 26, one day after the earliest documented operational effect. Our report documents the county’s Aug. 27 confirmation of unauthorized activity, continuing forensic work and dispatch continuity. The county’s website carried a department-level Register of Deeds outage notice but no countywide incident update. This chronology supports organization-first cyber characterization and organization-documented disruption.
The latest dated operational-impact update is Sept. 15, when electronic recording resumed but the Register of Deeds warned of processing delays during catch-up work. No newer dated disruption or countywide restoration has been confirmed. WMUR reported that the county said Sept. 29 its systems were contained and there was no active threat, while an investigation continued into whether personal information was involved. Containment does not establish complete service restoration. In Oct. 7 reporting, Cunningham said the county used backups to restore systems safely and did not need to pay a ransom. He did not give a final all-systems restoration date or identify a demand amount.
As of Oct. 19, the incident is presumed resolved because 34 days have passed since the latest supported operational-impact observation and no newer continuing disruption was established in the review. This is an assessment of operational status, not confirmation of complete restoration. The exact restoration date remains unknown.
Confidence is high that county systems and services were disrupted, based on county statements and contemporaneous reporting. Cunningham’s direct statement confirms ransomware involvement and nonpayment. The Booba Project listing matches the county’s domain, but its attribution and data-theft assertion have not been independently corroborated. The public record does not establish encryption, the amount of any demand or what data, if any, was accessed or removed.
The public record does not identify the initial access method, malware, affected data categories, record count or a final restoration date. It also does not resolve whether Booba Project was involved in the county incident or whether the group’s alleged 3 GB of data came from county systems.
Booba Project listed ‘The Merrimack County’ and alleged theft of 3 GB of data. The listing links to the county’s domain, merrimackcounty.net, supporting the victim-identity match. The claim is not confirmation that Booba Project carried out the network intrusion, deployed ransomware or obtained county data.
We reported that Merrimack County confirmed its investigation involved unauthorized activity and that third-party forensic specialists were examining its extent and root cause. The county said certain systems remained offline and could limit services, while dispatch call taking and emergency responses remained fully functional; the Register of Deeds required paper-only filings.
Patch reported that Merrimack County confirmed a network security incident after dispatchers lost access to state criminal-data software. Some systems were restored while others remained offline, and the county engaged network security and third-party specialists.
The Concord Monitor reported Sept. 14 that the threat was contained but the Register of Deeds remained offline and systems were being restored on a rolling basis.
County Administrator Ross Cunningham said systems contained/no active threat; most services expected Sept. 15 with rolling restoration through the week. A forecast, not a completed restoration.
Official Sept. 15 post says internet service restored and e-recording accepted; electronic submissions may take additional time during catch-up work. Updated caption says paper documents scanned/current online, with edit date unknown.
County said Sept. 29 systems were contained and no active threat remained; investigation continued into personal information. Bow police reported records-request delays but unaffected dispatch and emergency services.
County Administrator Ross Cunningham said the incident involved ransomware, backups allowed the county to restore systems safely and the county did not need to pay a ransom.
The official county website identifies Merrimack County’s government departments and facilities and places county administration in Boscawen, New Hampshire.
Merrimack County’s Register of Deeds still said Sept. 2 that its office was experiencing a network outage and would temporarily accept only paper documents delivered in person or by mail. The notice establishes a continuing records-processing disruption and manual workaround.
Ransomware.live lists ‘The Merrimack County’ under Booba Project, links www.merrimackcounty.net and says ‘Stolen data: 3 GB.’
Sept. 26 browser check loaded the county-linked Landmark records portal with public search options. No search was submitted, no legal disclaimer accepted and end-to-end filing was not tested.
Signed-in members can report an error, update, or missing source.
