Ransomware disrupted Florida’s Sumter County Sheriff’s Office in 2024. Law-enforcement response continued, but staff used paper records for four months. Records reconstruction remained underway in April 2025; a final recovery date is unverified.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Dispatch, routing, assignment, coordination, or response-management functions were unavailable or materially impaired.
Police, fire, emergency medical, corrections, emergency management, or other public-safety operations were materially affected.
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.
The actor explicitly threatened to publish or publicly release victim data or incident details.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.
The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.
Sumter County Sheriff’s Office in Florida acknowledged ransomware Aug. 6, 2024, saying it had cut off attacker access while some records remained unavailable. Its initial statement said law-enforcement response continued. Contemporary local reporting carried the same distinction.
The incident is presumed resolved, with no verified final recovery date. WFTV’s April 24, 2025, follow-up documented continuing records reconstruction, rather than a completed return to normal.
The records manager described four months of handwritten reports and tickets, followed by scanning and re-entry work. Approximately 1,500 crash reports accumulated during the downtime. One employee was entering about 10 a day, illustrating the recovery backlog.
The sheriff also described dispatch-system problems as an early symptom. That technical disruption does not establish that emergency response stopped.
Confidence in ransomware is high because the agency directly identified it. The sheriff later attributed entry to an infected employee-supplied external hard drive. A detailed public forensic report remains unavailable.
Rhysida’s responsibility remains an attributed claim. WFTV’s Aug. 9 reporting described a public listing, apparent document samples and a demand for seven bitcoins, then approximately $425,000, with an Aug. 16 deadline. A monitored listing supports recording the allegation; it does not independently authenticate the allegedly stolen material.
The agency disputed that stolen records had been uploaded, while an Emsisoft researcher described a freely downloadable release claim. Those conflicting assessments remain unresolved; the reviewed reporting did not verify the files’ contents or complete scope.
The original acknowledgment establishes an Aug. 6 public disclosure, without specifying the attack or discovery day. The final backlog-clearance date, exact compromised data, encryption inventory and whether a ransom was paid remain unverified.
Rhysida claimed the agency as a victim Aug. 9, 2024. WFTV described apparent samples, a seven-bitcoin demand and an Aug. 16 deadline. In April 2025 the agency disputed publication, while a researcher described a claimed release of 839 GB across more than 160,000 files. These accounts do not authenticate the contents or establish the theft volume. Responsibility and any ransom payment remain unconfirmed.
Bushnell contains the agency’s public-service office at 250 E. McCollum Ave.
Jurisdiction of the affected sheriff’s office. The agency reported that law-enforcement response continued despite restricted records access.
The affected agency’s Wildwood and Bushnell offices are in Sumter County.
Wildwood contains the sheriff’s administrative headquarters and Records Division at 7361 Powell Road.
We reported the sheriff’s ransomware acknowledgment, restricted records access, continued law-enforcement response and investigation with state agencies and IT specialists.
The agency acknowledges ransomware, says it cut off attacker access and warns that access to some records is limited. It says law-enforcement response continues while state agencies and outside specialists assist.
Carries the sheriff’s statement that ransomware restricted access to some records while law-enforcement response continued. The agency describes cutting off attacker access and working with state agencies and IT specialists.
Reports Rhysida’s victim claim, apparent document samples and a seven-bitcoin demand with an Aug. 16 deadline. An Emsisoft researcher says the samples do not establish whether the group actually obtained the agency’s information.
Interviews document four months of handwritten reports and tickets, followed by continuing records reconstruction in April 2025. The sheriff attributes entry to an infected external drive, while accounts of alleged data publication conflict.
Signed-in members can report an error, update, or missing source.
