Orangeville Township
Orangeville Township ransomware
Summary
A July 2025 ransomware incident impaired Orangeville Township’s network in Michigan and prompted forensic review and restoration. The township later reported no evidence of data impact, while the exact recovery day, full cost and any ransom terms remain unestablished.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data impacts
-
No known data impact
Available evidence indicates that the incident did not materially affect the confidentiality, integrity, or availability of data.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Orangeville Township in Barry County, Michigan, experienced ransomware-related disruption to its network in July 2025. The township clerk’s Aug. 21 update identifies ransomware in its title and confirms impaired network functionality, forensic assistance and secure restoration.
We reported the incident Aug. 31. The township’s completed review found no evidence of data impact, including sensitive personal information. That is the reported investigative finding, rather than a reason to omit the separately documented operational disruption.
Operational significance
The available evidence establishes a township network interruption and restoration effort. It does not identify a complete affected-application inventory, quantify lost staff time or show that emergency services stopped operating.
Sept. 2 board minutes record estimated cyber-response expenditures and a $2,500 deductible payable by the township. The deductible is not the full incident cost. The minutes also document evidence-preservation and security-policy work; those later actions do not establish a continuing outage.
Confidence and uncertainty
Confidence is high that a cyber incident impaired network functionality because the township directly acknowledged it. The official update’s ransomware characterization supports confirmed ransomware involvement. No named actor was established in the reviewed evidence.
The dates describe different milestones. In an Aug. 18 public post, Trustee Corey Ribble attributed a July 26 incident date to information from other board members. His account places discovery July 28 and the first board briefing July 31. These are reported dates, not independently reconstructed forensic timestamps.
The Aug. 12 minutes establish that the clerk commented publicly on the cyber incident with attorney authorization. Ribble’s criticism of delayed communication is his assessment. His Aug. 21 follow-up relayed the clerk’s findings and said specialists secured and restored the system.
Analytic gaps
The initial access method, exact restoration day, detailed technical scope, total response cost and any ransom demand or payment remain unestablished. No independently verified leak or named-actor claim was located. The township’s no-evidence finding should remain attributed to its investigation; generic ransomware leak patterns do not establish theft in this event.
The incident is resolved based on the completed-investigation and restoration accounts available by Aug. 21, 2025. The last dated initial disruption milestone located is the reported July 28 discovery. The exact end date remains unset; the previous draft’s Aug. 20 date was unsupported. Later board follow-up is not a new operational-impact observation.
Organizations involved
Impacted location
Orangeville Township, Michigan
Retains the township municipality as the anchor for its hall and affected local-government network. The paired jurisdictional service area is represented separately; this does not imply disruption at every property.
The affected township government’s jurisdiction is the existing Orangeville Township municipality. This identifies its governmental service remit, not a finding that every public service or location was offline.
Sources
Our report described a township network disruption, forensic findings and a trustee’s chronology.
The trustee distinguished a reported July 26 incident from July 28 discovery and a July 31 board briefing.
The township confirmed network-functionality impact, forensic assistance, secure restoration and a completed review finding no evidence of data impact.
The trustee relayed the clerk’s completed-investigation findings and said specialists secured and restored the system.
Minutes record the clerk’s attorney-authorized cyber-incident comments and a deferred two-factor authentication policy.
Minutes identify a $2,500 township deductible for the cyber incident and later evidence-preservation and security-policy work.
See something that needs correction?
Signed-in members can report an error, update, or missing source.