Claim details
Qilin claimed responsibility for Rusk County’s March 2026 incident. The county confirmed a cyber incident but did not name Qilin; a separate Lynx claim concerned a November 2025 outage and is not attributed to this incident.
Rusk County cybersecurity incident
Summary
A cybersecurity incident affected portions of Rusk County’s network and led the county to engage forensic specialists while restoring safe, remediated systems. Qilin later claimed the March incident at low confidence because the county did not corroborate attribution; a Lynx listing concerned a separate November 2025 outage. The dated effects are older than 30 days with no continuing outage identified, supporting presumed-resolved status.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
DD-CIT assessment
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Extortion indicators
-
Leak-site listing
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
-
Data-theft extortion
The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.
Incident narrative
Analyst assessment
DysruptionHub reported that a cybersecurity incident affected portions of Rusk County’s network and led the county to engage forensic specialists while restoring safe, remediated systems. Qilin later claimed the March incident at low confidence because the county did not corroborate attribution; a Lynx listing concerned a separate November 2025 outage.
The evidence supports a confirmed cyber assessment. County disclosures confirm cyber causation, while ransomware is supported only by the later Qilin claim.
Operational significance
The county’s restoration language supports disruption to parts of the government network, although officials did not identify each unavailable public service.
The affected jurisdiction was Rusk County, Wisconsin. No evidence supports extending this record to unrelated local governments or the county’s prior November outage.
Confidence and uncertainty
Confidence is high that the county experienced a cyber incident requiring network restoration. Qilin alleged theft, but the county’s public statements did not establish exfiltration or affected data categories.
The dated effects are older than 30 days with no continuing outage identified, supporting presumed-resolved status.
Analytic gaps
The public record does not establish the access vector, malware, affected departments, ransomware execution, exfiltration scope, ransom terms and restoration date. Threat-actor allegations, where present, are preserved as claims and do not by themselves establish responsibility, access scope, data provenance or payment.
Threat actor and claim
Organizations involved
Rusk County, Wisconsin
Locations
Organization type
Critical infrastructure
Impacted locations
Sources
Rusk County said a cybersecurity incident affected its network environment and forensic specialists were helping restore safe systems.
Rusk County said the March cybersecurity incident affected certain parts of its network environment.
Qilin claimed responsibility for the March incident. Reporting distinguished this claim from a separate November 2025 outage claimed by Lynx.
The Census Bureau Gazetteer Files provide authoritative geographic reference data for states, counties, county equivalents and places in the United States.
The organization’s official website describes its identity, services, operating role and public or customer-facing programs.
See something that needs correction?
Signed-in members can report an error, update, or missing source.