Peak Software Systems ransomware outage

Analyst assessment

We reported that attackers encrypted Peak Software Systems infrastructure, backups and internal systems supporting the Sportsman platform, disrupting municipal parks and recreation services. Clute said Peak obtained decryption keys and began restoration March 1. Lehi City later said an unauthorized party accessed certain systems and that files held in Sportsman may have been accessed or acquired.

The evidence confirms a cyber incident and supports a high-confidence ransomware assessment. Encryption, affected backups and the use of decryption keys form a strong ransomware pattern, but the public record does not identify a ransomware family, ransom demand or stable threat-actor claim.

Operational significance

Municipal customers lost online and in-person registration, reservations and rentals. Some facilities shifted to cash, and program deadlines or swim-lesson registration were delayed. Documented downstream organizations are the municipal governments of Clute, Texas; Garden City, Michigan; Brigham City, South Jordan and Lehi, Utah; and Monroe, Wisconsin.

Brigham City said its delayed swim registration would open March 16. Lehi’s April 9 notice says systems had been restored and the incident contained. Because that notice describes the February event retrospectively rather than a continuing April outage, March 16 remains the last documented operational impact date and the incident is resolved.

Confidence and uncertainty

Confidence is high that the attack encrypted Peak systems and disrupted Sportsman services. Lehi’s notice supports possible confidentiality impact involving names, dates of birth, contact details, emergency contacts, school information, parents’ names and home addresses, but it does not establish that those files were accessed or acquired. Lehi said Peak had no current indication that Social Security numbers or financial account information were involved; Clute said payment cards were processed in a separate environment.

Disclosure posture

Garden City publicly documented a service disruption Feb. 26 without cyber wording. An official Clute cyber notice was available before and underpinned our March 5 report, making this an organization-first cyber disclosure followed by external reporting. Feb. 26 remains the incident’s first public operational signal, while March 5 is the earliest dated public cyber-specific signal established in the record.

Analytic gaps

The public record does not establish the actor, initial-access vector, ransomware family, ransom demand, payment, verified data acquisition or exfiltration, complete affected-customer count or the exact date of Clute’s first cyber post.