Skip to content
DysruptionHub
Sign in Subscribe

Strafford County cyberattack disrupts communications

Summary

Strafford County logo

Strafford County experienced communications and computer-system disruption beginning by March15,2025, affecting county offices and a court proceeding. Officials reported98%restoration March25 and said no ransom demand had been received then. DragonForce later alleged data theft and threatened publication. Complete recovery timing, encryption and the group’s responsibility remain unverified.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
Unresolved
Attribution:
Unresolved

Attack mechanisms

  • Unknown cyber mechanism

    The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.

Data impacts

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Email disruption

    Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.

  • Phone service disruption

    Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Records access disruption

    Staff, customers, patients, students, residents, or other users could not access records or case information normally.

  • Scheduling disruption

    Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.

  • Healthcare operations disrupted

    Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.

  • Government services disrupted

    Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

  • Downstream organization impact

    The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.

Extortion indicators

  • Data-theft extortion

    The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.

  • Public leak threat

    The actor explicitly threatened to publish or publicly release victim data or incident details.

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

  • Countdown or payment deadline

    The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.

Incident narrative

Analyst assessment

A cyber incident disrupted Strafford County government communications and computer systems in March 2025. County Administrator Ray Bower later said he learned of the problem March 15 when Riverside Rest Home staff could not access county systems. That is the earliest dated operational problem established in the reviewed evidence, rather than a verified intrusion date.

The disruption interrupted an attempted-murder trial March 17. DysruptionHub’s original report attributed a cyberattack acknowledgment to county prosecutor Joachim Barth. The reviewed evidence does not establish compromise of the wider state court network.

Operational significance

County offices experienced email, telephone and computer-system limitations. A March 24 report quoted a county spokesperson saying some systems remained offline during investigation and restoration. The nursing home continued medical operations using paper workflows, according to later reporting. The sheriff’s department used a separate system and was reported unaffected.

On March 25, commission Chairman George Maglaras reported 98% restoration and functioning email. Individual computers still required attention, with safeguards around payroll and banking information. Those precautions do not establish theft of financial data.

Confidence and uncertainty

Confidence is high in the county incident and operational disruption, supported by named officials and contemporary reporting. The earliest located public reports appeared March 17. The record includes organization-origin acknowledgment of cyber involvement and operational effects, although technical details remain limited.

Maglaras said in March that officials did not believe ransomware was involved because no demand had been received. That contemporaneous account differs from DragonForce’s later public claim. Neither account independently establishes that ransomware encrypted county systems.

The historical incident is assessed as presumed resolved. March 25 is the latest verified operational-impact observation in this review; 98% restoration does not establish complete recovery, and the former April 6 end date lacked support.

Analytic gaps

Comparitech reported a DragonForce listing June 16, an alleged 830.03 gigabytes of stolen data and a five-day publication threat. The county had not confirmed those allegations. The listing’s existence is supported, but attribution, file volume, encryption, exfiltration and any subsequent publication remain unverified. The entry route, complete affected-system inventory and exact final restoration date are also unknown.

Threat actors and claims

DragonForce

Listed as: Strafford County NHSource: ransomware.livePublished: Discovered:

Claim details

DragonForce listed Strafford County NH using the strafford.nh.us domain. The tracker recorded discovery June16,2025, at20:37:18.024969UTC; its saved date field retains calendar precision. Comparitech’s report, updatedJune16, describes an alleged830.03GB and five-day publication threat. The county had not confirmed the claim. In March25original reporting, officials said no ransom demand had been received and they did not then believe ransomware was involved. Preserve that chronology: the listing does not independently establish attribution, encryption, filevolume, dataexfiltration or actualpublication. Genericgroupmethods and unrelatedGeoLogicsvictimfigures are notincidentfindings.

Organizations involved

Impacted locations

  • Dover, New Hampshire

    The official county directory https://www.co.strafford.nh.us/county-information/departments-resource-agencies-directory places county administration and the county attorney at259CountyFarmRoad,Dover. ExactCensusstreetmatch verifiesDovercity3318820 andStraffordCounty33017. Use existingDovermunicipality as the affectedgovernment’s physicalofficeanchor, not a citywideoutage. State-operatedcourtcontextdoesnotmakeDovermunicipalgovernmentavictim.

    Source

  • Strafford County, New Hampshire

    The county’s official functions/government overview https://www.straffordcounty.gov/ establishes public-service responsibility for StraffordCounty, comprising threecities andtentowns. Pair geographiccountyservice_area andincidentimpacted_area with separateDoversite. The overlay identifies affectedgovernmentremit, not simultaneousoutagesinallmunicipalities or everydepartment; the sheriff’s independent network was expressly unaffected.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.