Patriot RECC and Town of Pepperell ransomware incident

Analyst assessment

DysruptionHub assesses with high confidence that the Patriot Regional Emergency Communications Center was the primary operational victim and the Town of Pepperell was a direct co-victim of a confirmed ransomware incident beginning March 31, 2026. PRECC is a regionally governed shared service administered through Pepperell, not a separate municipality. The five member towns established it through an intermunicipal agreement: Pepperell conducts day-to-day operations and supplies personnel and facilities, while a board with representatives from Ashby, Dunstable, Groton, Pepperell and Townsend provides regional governance.

Pepperell Police’s official incident statement said the town, PRECC, police and fire departments were responding to a cyberattack affecting municipal and public-safety computer systems. A later Select Board record attributed the event to ransomware and said Pepperell’s network experienced approximately one week of disrupted access. Those sources support direct-victim status for both PRECC and Pepperell: PRECC was the shared operational hub attacked, while Pepperell was more than its host location because the town’s own network and municipal systems were also affected.

Our initial report documented the municipal and regional-dispatch effects. Subsequent municipal statements and The Sun’s regional reporting establish that the operational footprint included all five PRECC member towns. The evidence supports confirmed ransomware at PRECC and Pepperell, but it does not establish the ransomware family, deployment method, encryption scope, responsible actor, extortion demand or payment.

Operational significance

The incident affected Pepperell’s municipal network and a shared public-safety communications dependency. Non-emergency or business telephone lines serving police, fire or EMS functions were disrupted in Pepperell, Ashby, Dunstable, Groton and Townsend. Townsend said its affected lines were restored after a brief outage. Ashby was still directing routine police calls to an alternate number April 4. Pepperell’s later minutes described about one week of disrupted network access.

The four neighboring towns are classified as impacted customers rather than direct ransomware victims. Their documented disruption flowed through PRECC. Dunstable said its police and fire departments disconnected from the center as a precaution and that it had no evidence systems owned or managed by the town were affected. The reviewed sources do not show that Ashby, Groton or Townsend municipal networks were compromised. Police, fire and EMS departments are represented within their town governments rather than as separate organizations because the affected functions are municipal departments, not independently identified victims.

Core emergency response continued operating. The 911 system remained available, and police, fire and EMS agencies continued responding to emergency calls. Residents needing non-emergency public-safety assistance were directed to alternate telephone numbers while business lines were unavailable. The outage was therefore a partial but material regional disruption, not a complete loss of emergency dispatch.

Disclosure posture

Pepperell publicly characterized the event as a cyberattack April 1, one day after officials became aware of it, and disclosed involvement by outside cybersecurity firms, insurers and law-enforcement partners. Dunstable and Townsend issued their own statements, Ashby posted an alternate-number notice, and Groton Police attributed its business-line outage to the attack in a social post quoted by The Sun. Initial statements said there was no evidence that private user information had been shared while specialists were determining what information may have been accessed. The later ransomware characterization narrowed the attack-type uncertainty but did not resolve the data-exposure question.

Current status

The April 29 Select Board minutes describe approximately one week of disrupted Pepperell network access after the March 31 attack. That retrospective statement supports an operational end around April 7 and a resolved status. It does not amount to a final forensic report or establish that every investigation, security-hardening task or potential notification obligation was complete.

Confidence and uncertainty

Confidence is high that ransomware affected PRECC and Pepperell because the town administrator later identified the event as ransomware and contemporaneous official statements documented cyber-related disruption to town and public-safety systems. Confidence is also high that PRECC-related non-emergency public-safety phone service was impaired across all five member towns while 911 and emergency response continued.

Threat-actor attribution remains unresolved because no actor or group was named and no stable public claim of responsibility was identified. Data impact remains unknown: initial statements found no evidence that private information had been shared, but investigators were still assessing possible access. The public record also does not disclose a ransom demand, negotiation, payment or data-leak threat.

Analytic gaps

The reviewed sources do not establish the initial access vector, compromised account or host, exploited vulnerability, attacker dwell time, ransomware family, persistence method, command-and-control infrastructure or whether systems were encrypted rather than intentionally isolated during response. They also do not identify precisely which municipal and dispatch systems were directly compromised.

The record does not establish whether data was accessed, copied, altered, encrypted, deleted or publicly released; which data categories or record counts may have been involved; whether an extortion demand was received; or whether any payment was made. No final forensic report, actor attribution, detailed restoration sequence or incident-response cost has been published in the reviewed sources.