South Shore Regional Emergency Communications Center
South Shore dispatch malware outage forces manual procedures
Summary
A malware-related outage disabled South Shore Regional Emergency Communications Center’s computer-aided dispatch software on Aug. 2, 2025. Dispatchers used manual procedures while 911 calls and emergency responses continued without reported delays.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing. -
Incident end:
?
Confirmed or defensibly assessed end of material operational disruption or incident activity.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Malware
Malicious software other than ransomware used to compromise or disrupt systems.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Dispatch disruption
Dispatch, routing, assignment, coordination, or response-management functions were unavailable or materially impaired.
-
Public safety operations disrupted
Police, fire, emergency medical, corrections, emergency management, or other public-safety operations were materially affected.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
South Shore Regional Emergency Communications Center in Hingham, Massachusetts, experienced a malware-related computer-aided dispatch outage on Aug. 2, 2025. A statement submitted by the center describes problems beginning at 9:30 a.m. and an intentional act that made the CAD system unusable. It identifies an unnamed member community as the apparent target.
Operational significance
Dispatchers used trained manual procedures. The center said no 911 calls were missed, service remained available and emergency responses were not delayed. This was a material failure of dispatch-support software with continuity measures preserving public-facing emergency response.
An official same-day notice states that the software issue was resolved at 8 p.m. Aug. 2. That supports a same-day operational end rather than an assumed recovery date. Later reporting of the investigation does not extend the outage.
The center serves Cohasset, Hingham, Hull and Norwell. Their municipal areas describe its public-service remit, not four separately confirmed municipal compromises.
Confidence and uncertainty
Cyber involvement is supported by the center’s statement, which identifies Information Management Corporation as the CAD provider and Global Data Systems as IT support. Our Aug. 5 report covered the dispatch disruption.
The statement’s qualified reference to malware from a group with Russian ties does not identify an actor or establish state direction. No ransomware, encryption, ransom or payment finding was found. The center said confidential-information compromise was unknown; no later verified data-theft finding was located.
Analytic gaps
The initially targeted member community, entry route, malware family, technical indicators, data impact and response cost remain unestablished. Provider assistance is not evidence that either vendor was compromised or that a supply-chain attack occurred.
The Aug. 2 software notice establishes an earlier public operational signal than the dated Aug. 4 cyberattack coverage. The precise timing of an earlier public cyber disclosure remains unverified.
Operations are resolved on the strength of the center’s explicit 8 p.m. Aug. 2 restoration notice. The initial disruption, latest impact and operational end fall on Aug. 2.
Organizations involved
Impacted locations
Cohasset, Massachusetts
Cohasset falls within the affected dispatch center’s service remit. CAD-support disruption required manual procedures; no 911 service failure, response delay or separate municipal compromise is inferred.
Hingham, Massachusetts
Hingham falls within the affected dispatch center’s service remit. CAD-support disruption required manual procedures; no 911 service failure, response delay or separate municipal compromise is inferred.
Hingham contains the regional center’s main office at 210 Central Street. This site anchor does not identify Hingham town government as the unnamed initial target.
Hull, Massachusetts
Hull falls within the affected dispatch center’s service remit. CAD-support disruption required manual procedures; no 911 service failure, response delay or separate municipal compromise is inferred.
Norwell, Massachusetts
Norwell falls within the affected dispatch center’s service remit. CAD-support disruption required manual procedures; no 911 service failure, response delay or separate municipal compromise is inferred.
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.