A March 2024 ransomware attack disrupted Tarrant Appraisal District’s network and public services. Essential services and online appraisal protests had returned by April 26, with an extended protest deadline to compensate for delayed access.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Stolen, exposed, or otherwise compromised data was publicly released, posted, distributed, or offered for download.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
A public-facing website was unavailable, disabled, or inaccessible.
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
An authoritative source stated that no ransom or extortion payment was made.
Tarrant Appraisal District experienced a network disruption on March 21, 2024. Contemporary reporting described unusual network behavior and a protective system shutdown that made its website unavailable. In a district statement republished March 22 by Haslet, the victim confirmed ransomware and notification of the FBI and Texas authorities.
The incident disrupted appraisal information and public contact channels during property-appraisal season. Although the website returned in part within days, email and telephone service remained unavailable in initial reports.
Reporting on the April 22 board meeting said most systems had returned, but the dashboard and online protest functions were still expected later that week. The district offered in-person appraisal assistance. An April 26 follow-up reported essential services and the online protest function restored. The residential protest deadline moved from May 15 to May 24 to compensate for delayed access. This establishes recovery of those functions by April 26, without identifying the exact restoration day or proving every internal system had recovered. The incident is presumed resolved.
The board had approved $490,000 in security upgrades by April 22, according to the board-meeting coverage. These authorizations are distinct from a final tally of incident costs or a ransom payment.
Confidence in ransomware involvement and service disruption is high. The April board-meeting report identifies Medusa, publication of compromised data and the district’s refusal to pay. It describes about 300 potentially affected people as an early estimate, rather than a final count. The ransom reportedly fell from $700,000 to $100,000.
The separate tracker listing’s alleged 217.79 gigabytes is an attacker claim, not an independently verified measurement. Its discovery timestamp does not establish original claim publication.
The entry method, final affected-person count, complete stolen-data inventory and exact restoration date remain unresolved. Security upgrades and replacement-system plans do not establish continuing outage. The earlier 2022 incident and preceding database failure are distinct events.
Medusa listed the district and alleged 217.79 GB of data. That volume is unverified. April board-meeting reporting independently identifies Medusa, ransom demands, data publication and the district’s refusal to pay. Tracker discovery is not attack date.
Fort Worth anchors the appraisal district’s affected offices; this is not a Fort Worth municipal-government outage.
Tarrant County is the appraisal district’s property-appraisal jurisdiction. The overlay identifies service reach, without asserting that all county agencies were attacked.
The chief appraiser described unusual network behavior around 3 a.m., a protective shutdown that made the website unavailable, and work with outside experts to secure and restore systems.
The district confirmed a criminal ransomware attack after its March 21 network disruption, engaged independent specialists and reported the incident to the FBI and Texas Department of Information Resources.
The district confirmed ransomware and notified the FBI and Texas authorities. Its website had returned, but email and phone lines remained down ahead of an emergency board meeting.
At the April 22 meeting, most systems were back but dashboard and online protests remained pending. Reporting identified Medusa, published data, about 300 potentially affected people and the district’s refusal to pay.
Essential services and online appraisal protests were back online. Officials extended the residential protest deadline from May 15 to May 24 because the attack had delayed access to the protest tool.
The tracker lists Tarrant Appraisal District under Medusa and alleges 217.79 gigabytes of data. The quantity remains unverified.
Signed-in members can report an error, update, or missing source.
