A September 2025 ransomware incident disrupted bond processing, detainee releases and court information systems at the Orleans Parish Sheriff’s Office in Louisiana. Court and audit-access problems persisted after early platform restoration, while Qilin’s later data-theft claim remained unverified.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
The organization could not process, receive, issue, reconcile, or record payments normally.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Police, fire, emergency medical, corrections, emergency management, or other public-safety operations were materially affected.
Services continued but with longer processing, response, delivery, or completion times.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.
The Orleans Parish Sheriff’s Office in Louisiana experienced a confirmed ransomware incident that disrupted releases, bond-related work and court information systems in September 2025. We reported the incident Sept. 4 and later updated our account as court and oversight effects extended beyond the initial outage.
Early reporting established that the AS400 platform went offline Sept. 4 and returned by the evening of Sept. 5. That was a recovery milestone for one platform, rather than proof that all agency systems and dependent functions had recovered.
Disrupted processing delayed some detainees’ releases, while the agency said jail security and its main jail management system remained operational. Contemporary reporting also documented a prolonged DocketMaster outage and an agency telephone workaround for case information. Our updated report records the Sept. 22 restoration announcement for that public lookup system.
The Civil District Court’s Sept. 19 account described a separate sheriff civil-system outage lasting 15 days, impairing service-of-process verification and related pleadings. Judges established contingencies; the evidence does not establish that the entire court stopped operating.
Effects persisted beyond the public lookup restoration. Reporting published Oct. 9 quoted the legislative auditor describing server rebuilding and unavailable online access needed to complete audit work. That is a documented continuing records-access and oversight interruption.
Confidence is high in ransomware involvement and material disruption because agency and court statements, named officials and reporting document both. A reported employee email described substantial data loss, but that phrase does not establish the mechanism, final amount or whether information was exfiltrated.
Claim reporting describes Qilin alleging responsibility and publishing purported administrative and financial documents; later reporting described a claimed 842 gigabytes. Confidence in attribution to Qilin is low because the named link rests on its claim. Neither the alleged volume nor the complete authenticity and scope of the files has been independently established in the reviewed evidence.
The initial access method, full affected-system inventory, final recovery cost, ransom terms and any payment remain unestablished. Early assurances about sensitive jail records should not be generalized to every administrative record. The public evidence supports several distinct service interruptions and partial recoveries, rather than one verified restoration date for the entire agency.
The latest specific continuing-impact observation verified is Oct. 9, 2025. No authoritative complete-recovery date was found through Oct. 23, 2026, so operations are presumed resolved based on elapsed time. Later publication or retrospective updates do not establish a continuing outage by themselves.
Qilin claimed the Orleans Parish Sheriff’s Office under its historical opso.us domain and published alleged administrative/financial samples. Reporter-viewed claim described asSaturdaySept.13; exactprimarypostingtimestampunverified. Ransomware.live discovery2025-09-14T16:20:11.827948Z retained separately. Claimed842GB volume and full file authenticity are not verified. Aggregator’s staleformerSheriffname and Technologysector are not organizational facts.
Retains New Orleans as the municipality anchor for sheriff facilities and affected justice-related operations. The parish service jurisdiction is represented separately; jail-security continuity is preserved in the assessment.
Sheriff jurisdiction and dependent court services cover Orleans Parish. This identifies the affected governmental service area, not a claim of an outage at every resident or parish facility.
We reported the ransomware incident and later expanded coverage of court, data-claim and audit effects.
The office reported AS400 restoration after interruptions to releases, bond payments and justice-agency communications; jail security remained operational.
The reporter observed a Qilin claim and alleged document samples, while OPSO described continuing restoration and a DocketMaster phone workaround.
An employee email described substantial data loss; the agency said two programs remained down and recovery continued.
Court officials described a 15-day sheriff civil-system outage affecting service verification and pleadings, with contingency procedures.
The legislative auditor said server rebuilding and unavailable online documentation delayed audit work.
Signed-in members can report an error, update, or missing source.
