Skip to content
DysruptionHub
Sign in Subscribe

Bourne municipal IT compromise and recovery

Summary

Town of Bourne logo

Bourne investigated a municipal IT compromise discovered Jan. 11, 2025. Major systems had been restored by March 4, and Massachusetts recorded a breach affecting 625 state residents. Police and 911 remained operational.

Key facts

Timeline

  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High
Ransomware:
High
Attribution:
Low

Attack mechanisms

Data impacts

  • Unauthorized data access

    An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

Incident narrative

Analyst assessment

Bourne, Massachusetts, investigated a compromise of its municipal IT network after the town was notified of a potential intrusion Jan. 11, 2025. The joint town and police announcement published Jan. 12 described an active criminal investigation. Barnstable County’s fiscal 2025 IT report later identified the event as a ransomware incident and said the county IT department coordinated containment and recovery.

Operational significance

The initial announcement said police services and 911 remained fully functional, while town phones and email did not appear affected at that time. Those assurances concern particular services and do not establish that the incident had no operational effect.

By the March 4 Select Board meeting, Town Administrator Marlene McCollem said town departments were operational and all major systems had been restored, according to CapeCod.com’s March 10 report. She also said no ransom was paid. This establishes recovery of major systems by that meeting, rather than an exact restoration date or continuous downtime from January through March.

Confidence and uncertainty

Confidence in the cyber incident is high. The county IT provider’s account supports the ransomware characterization, but the reviewed sources do not identify the entry method or describe which files, if any, were encrypted. A RansomHub tracker listing for the town’s former website domain is an external allegation; the town has not independently confirmed that group’s responsibility in the reviewed statements.

Massachusetts’ 2025 breach report lists Bourne filing 2025-303 as reported Feb. 21, with 625 Massachusetts residents affected and Social Security numbers, financial account information and driver’s license information marked as breached. That is a state-specific reported count, not a verified total for all jurisdictions. The town’s filed consumer letter says information may have been involved and offers 24 months of credit monitoring and identity restoration.

The county report separately says there was “no confirmed data loss.” That qualified statement does not resolve the scope of the reported privacy breach or independently establish that no information was accessed or copied.

Analytic gaps

The exact intrusion start, duration of individual service outages, final restoration date, method of access, confirmed volume of copied information and responsible actor remain unresolved. The notification template contains date placeholders, so it does not establish when particular letters were mailed. The reviewed evidence supports operational recovery without assigning the draft’s previously recorded March 3 end date.

Threat actor and claim

RansomHub

Listed as: www.townofbourne.comSource: ransomware.liveDiscovered:

Claim details

Ransomware.live indexes a RansomHub victim listing for www.townofbourne.com, observed Feb.27,2025, at22:07:29.260463UTC. The old municipal domain now redirects to bourne-ma.gov. The tracker provides no attack date, original actor-post URL, verified original publication date, data quantity or ransom demand; its municipal description is explicitly AI-generated background. The town independently acknowledged suspicious activity, and its county IT provider later called the January event ransomware, but neither reviewed primary account identifies RansomHub as responsible. The county’s qualified finding of no confirmed data loss must be distinguished from the town’s potentially affected consumer notifications and the state’s625-Massachusetts-resident filing. The listing alone does not establish encryption, data theft, publication or payment; the town administrator reported no ransom paid.

Organizations involved

Impacted location

  • Bourne, Massachusetts

    Bourne’s municipal boundary is the town government’s geographic service remit. Existing OSM administrative relation2387625/admin8 is independently verified; Census Geocoder places24PerryAvenue in Bourne town subdivision2500107175, Buzzards Bay CDP2510015 and Barnstable County25001, with no incorporated city. Reuse Bourne town as the municipal area. This paired overlay identifies the affected government’s remit and does not establish that every service, resident or facility experienced an outage; police and911 remained fully operational in the Jan12statement.

    Bourne contains the affected town government’s administrative offices at24PerryAvenue. This site-level relationship preserves the physical administrative anchor without asserting an intrusion origin or a police/911 outage.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.