Ransomware encrypted Monroe County, Indiana, virtual servers and forced county offices and courts to close for a week in July 2024. Operations resumed July 8. Later forensic findings confirmed earlier unauthorized access and file acquisition; 913 people were notified in 2025.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Unauthorized access to systems, accounts, networks, or data.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Internal or external network connectivity was unavailable or materially impaired.
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
The organization could not process, receive, issue, reconcile, or record payments normally.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
Services continued but with longer processing, response, delivery, or completion times.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
An authoritative source stated that no ransom or extortion payment was made.
Ransomware disrupted Monroe County, Indiana, government operations in June and July 2024. The county’s July 8 technology update attributed the intrusion to BlackSuit. Later forensic findings confirmed encryption and file acquisition. Cyber involvement, ransomware and the county’s attribution are supported; general descriptions of BlackSuit’s methods are not evidence of the entry method in this incident.
County offices and courts closed beginning July 1, with further closures announced through the workweek. Indiana Public Media’s July 2 report documents emergency alerts, inaccessible servers and court closures. Sheriff’s operations, jail staff, road deputies and highway workers continued operating. This was a government administrative and court disruption, rather than a failure of every county or emergency service.
The B Square’s July 5 report and subsequent updates describe continuing recovery, priority for financial and court systems, and uncertainty about preparing the following week’s payroll. That concern does not establish a missed payday. The regular jail book-in email resumed July 6, although jail operations had continued.
In a July 19 report, county administrator Angela Purdie described the loss of email and network-drive access during the outage. The treasurer and auditor froze county bank accounts, delaying vendor payments. Secure backups supported recovery. The retrospective report says government functions had returned to normal; its publication date does not extend the outage.
The county said it was fully operational July 8. An update that morning from the technology director said all production servers, including shared and departmental drives, were operating. Indiana Public Media also confirmed offices had reopened. These statements support resolved status and a July 8 operational end date; they do not mean the subsequent forensic and notification work was complete.
A counsel’s executive summary dated July 17, 2025 identified unauthorized activity from June 19 through June 30, 2024. A service account bypassed Duo authentication, with later administrative-account remote desktop activity; investigators could not determine how the first account was accessed. The county discovered the incident June 30, shut down servers and found encryption and ransom notes. June 19 is the documented intrusion start, July 1 the first public disruption notice, and July 8 the county’s public BlackSuit acknowledgment. July 5 recovery work is the latest reviewed positive operational impairment before the July 8 restoration.
The executive summary confirmed file acquisition and reported notification of 913 people in early April 2025. Its attached notice letter and breach-notification form are dated April 1, while the summary says April 2. The filed form and the Indiana attorney general’s 2025 breach report list 899 Indiana residents; the summary lists 898. Both give 913 people overall. The filed form identifies names, Social Security numbers and driver’s license or state ID numbers as affected information, without establishing that every person’s record contained every field.
Notification and the report’s later release are consequences of the same incident, with no evidence of a new operational outage. The report was authored in July 2025 and publicly released August 26.
In responses published by The B Square in August 2025, the county said negotiations took place but no ransom was paid. It also said law-enforcement, jail, health-department and clinic files were not exposed. Reported legal and forensic expenses were professional-service costs, not a ransom.
Investigators could not determine how the first account was accessed. The reviewed evidence does not establish a ransom amount or a public data leak. The county’s later forensic and notification work should not be treated as evidence of continuing operational outages after July 8.
Monroe County’s July 8, 2024, public technology update identified BlackSuit as responsible for its network intrusion. This relationship records the county’s attribution, not a verified actor leak-site post. Later forensic findings confirmed ransomware encryption and file acquisition. No original BlackSuit listing date, post URL, ransom amount or public data release is verified.
Bloomington contains the county commissioners’ courthouse offices and the circuit court’s Charlotte Zietlow Justice Center. County offices and courts closed during the network outage; this city anchor does not imply a citywide outage.
The affected county administration and circuit court operate from offices in Bloomington within Monroe County. This physical-site relationship is separate from their countywide governmental and judicial remit.
Monroe County is the affected county government’s and circuit court’s geographic jurisdiction. Administrative offices and courts closed, while sheriff, jail and emergency operations continued. The jurisdiction overlay does not imply every service throughout the county stopped.
We reported that ransomware disrupted Monroe County offices and courts for a week. The county attributed the attack to BlackSuit while investigating its scope.
Emergency alerts announced court closures beginning July 1 because county servers were inaccessible. Sheriff, jail, road-deputy and highway operations continued.
Recovery work continued July 5, with financial and court systems prioritized. A July 8 update reported that all production servers and shared and departmental drives were operating.
The commissioners identified BlackSuit as responsible for the network intrusion and said county government was fully operational July 8, 2024.
County officials confirmed a BlackSuit ransomware attack and county offices reopened July 8. The scope of affected information remained under investigation.
MCG Technology Update
On July 1, 2024, Monroe County experienced a network intrusion by a source known as “Blacksuit.” The perpetrator has been identified. We’re working with third-party experts to assess the situation.
Currently, no evidence suggests misuse of employee information. However, we are still investigating whether vendor or public user PII has been accessed. We will notify affected individuals if necessary.
This is an active investigation, and updates may take weeks. Monroe County Government remains fully operational. We appreciate your patience and recommend locking your credit as a precaution.
County administrator Angela Purdie described the loss of email and network-drive access. Frozen county bank accounts delayed vendor payments, and secure backups supported recovery.
Counsel’s summary documents June 19–30, 2024, unauthorized activity, encryption and file acquisition. It reports notification of 913 people in April 2025.
The report describes the release of the county’s forensic summary and notification of 913 people. County responses said negotiations occurred but no ransom was paid.
The regulator’s report lists 913 people affected, including 899 Indiana residents, a June 19, 2024, breach date and April 1, 2025, notification.
Signed-in members can report an error, update, or missing source.
