Murray County ransomware closes government offices

Analyst assessment

Murray County’s May 13 public notice said the tax commissioner, tax assessor, probate and juvenile-court offices would remain closed until the county network was restored, while other offices operated with limitations and voting continued. DysruptionHub’s published report documented that the county described the disruption as a cyberattack and said 911 and public-safety operations remained available.

Subsequent WTVC reporting said county officials identified the incident as ransomware, restored most systems, and paid $200,000 to prevent publication of county data. DysruptionHub assesses with high confidence that this was a confirmed ransomware and data-extortion incident with material disruption to county administrative services. The available statements do not establish whether files or systems were encrypted.

Operational significance

The attack affected county functions that depend on networked records, applications and office communications. Residents encountered closed offices and could not complete some tax, tag, assessment, probate and court-related business through normal channels. The disruption therefore affected both staff workflows and public access to routine government services.

Critical public-safety and election functions were maintained. County statements said 911, public safety and voting continued, which limits the supported impact on emergency and election operations. The incident nevertheless produced a substantial administrative outage across several county offices.

Disclosure posture

Murray County publicly disclosed the operational disruption on May 13, identifying the offices that were closed or limited and tying their reopening to network restoration. Later county statements identified the event as ransomware and disclosed that most systems were operational and that the county paid the attackers after consulting outside cybersecurity and forensic advisers.

The county said the payment was intended to prevent publication of county data. That supports data-theft extortion and a public-disclosure threat, but the public record does not identify the data involved, establish whether the attacker provided samples, independently confirm exfiltration, or show that any information was ultimately released.

Confidence and uncertainty

Confidence is high that ransomware occurred because county officials used that characterization and reported a payment to the attackers. Confidence is high that government services were disrupted because the county’s own notice documented closed and limited offices.

Confidence is medium that data was exfiltrated. The payment rationale indicates that attackers claimed possession of county data and threatened publication, but no forensic report, affected-data inventory, breach notice or independent validation was identified. The payment was described as preventing publication, not obtaining a decryptor, and no available statement confirms encryption. No threat actor was named.

Retrospective note

By June 12, county officials said the ransomware attack had been resolved and most systems were operational while secure restoration continued. This provides positive recovery evidence, although the public record does not establish that every system and backlog had returned to normal. DysruptionHub therefore assesses the operational incident as resolved based on the county’s restoration statement.

Analytic gaps

The reviewed sources do not establish the initial access vector, compromised account or device, ransomware family, whether encryption occurred, dwell time, backup impact, affected servers or exact restoration sequence. They also do not identify the data categories allegedly stolen, the number of affected individuals or records, the payment method, whether any data was published, or the identity of the attackers.