The City of Flint
Flint municipal ransomware attack
Summary
An August 2024 ransomware attack disrupted Flint’s municipal network, billing and communications. Online payments returned Sept. 6 while phone recovery continued. Emergency response and water services remained operational; a final restoration date is unverified.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
-
Email disruption
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Event or activity cancellation
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
A ransomware attack disrupted Flint, Michigan’s municipal network in August 2024. The city’s original social post announced a network outage Aug. 14; an explicitly dated Aug. 15 update identified ransomware. The earlier generic notice does not establish an earlier public cyberattack acknowledgment.
The incident is presumed resolved, with its final restoration date unverified. The city’s Sept. 6 recovery update reported restored online payments while phone-system testing continued.
Operational significance
The Record’s contemporary reporting described disrupted billing, mapping and communications services. Residents initially had to use cash or checks for water, sewer and tax bills because online and card payments were unavailable. Email access was uneven, phone service had gaps and voicemail messages could be lost.
Emergency response, including 911, police and fire services, continued. Public works and public health services also remained available, and the separately hosted city website stayed accessible. A later police budget submission described disruption within the Police Department and a resulting cloud-service migration. That record does not establish that 911 or frontline response stopped.
Confidence and uncertainty
Confidence that this was ransomware is high because Flint directly identified it as such. The city reported Aug. 26 that it had rebuilt its network and restored most servers from backups. This documented recovery progress did not establish that every public service had returned.
The reviewed evidence does not identify the attacker, a payment or a particular encryption scope. Whether resident or employee information was compromised remained under investigation in the initial disclosures. Those uncertainties are preserved rather than converted into confirmed theft or a finding that no data was affected.
Analytic gaps
The latest precisely dated continuing recovery observation is Sept. 6, when phone restoration was incomplete. A Sept. 9 republication described that earlier announcement; its publication date is not a new observation of disruption. The separate final recovery day remains unknown.
The city also canceled Aug. 21 committee meetings, citing technological and staffing issues together. Available evidence does not isolate each cause’s contribution. No responsible group has been independently established.
Organizations involved
Impacted locations
Flint, Michigan
Flint contains the municipal headquarters at 1101 S. Saginaw St.
Municipal jurisdiction of the affected city government. The reported disruption concerned administrative systems; emergency response, public works and water delivery continued.
Genesee County, Michigan
County containing affected Flint municipal facilities. County geographic site anchor does not establish that Genesee County government was compromised.
Sources
We reported Flint’s ransomware disruption, unavailable online and card payments, uneven communications and the continued availability of emergency services. Our account describes an investigation into possible personal-data involvement.
The city’s post initially announces a generic network and payment outage Aug. 14. An explicitly labeled Aug. 15 update identifies ransomware.
The city’s rolling updates describe the ransomware disruption and phased recovery. Its Sept. 6 update reports normal payment options restored while phone-system testing and intermittent service problems continue.
Reports disrupted municipal billing, mapping, email and phone services, with residents limited to cash or checks for bills. It says emergency response, public works and public health services continued while investigators assessed possible data theft.
A police staff review connects the Aug. 14 cyberattack with disruption within the Police Department and an emergency move to Tyler Technologies’ cloud-based service.
See something that needs correction?
Signed-in members can report an error, update, or missing source.