Cyber incident disrupts Milford, New Hampshire services

Analyst assessment

The Town of Milford, New Hampshire, disclosed unauthorized activity affecting municipal computer systems after phone and internet failures disrupted public services beginning July 15, 2026. Our reporting found that the town clerk lost access to state systems, the water utilities billing office closed, online payments were unavailable and remote participation in public meetings was suspended.

Milford’s July 16 official notice said third-party forensic specialists were investigating the unauthorized activity and that backup procedures allowed some services to continue with delays. A July 22 incident update said the investigation was continuing, several systems remained offline while officials analyzed whether they could be safely restored, and the town had not confirmed the cause or full extent.

DysruptionHub assesses with high confidence that unauthorized cyber activity caused material municipal disruption. That judgment rests on the town’s direct acknowledgement of unauthorized activity and its documented operational effects rather than inference from an unexplained outage.

Operational significance

The incident affected routine municipal transactions and communications across multiple departments. Residents lost normal telephone and internet access to town buildings, the clerk could not connect to New Hampshire systems, water billing operations closed, online payments were unavailable and vehicle-registration and vital-record requests could take longer than usual.

The town used backup processes and alternate service arrangements to continue important functions. Public meetings were recorded for later broadcast because Zoom participation was unavailable. Milford continued directing residents to call 911 for emergencies and did not report disruption to emergency dispatch or other public-safety operations.

Disclosure posture

Milford publicly characterized the event as unauthorized activity affecting computer systems and disclosed its forensic response, precautionary system isolation and workarounds. The July 22 update also addressed false rumors, saying officials had not confirmed the cause or extent. That caution leaves the attack type and technical scope unresolved; it does not reverse the town’s confirmation of unauthorized activity.

We reported that a resident and cybersecurity professional warned town officials in May about an internet-accessible Synology storage system. The evidence does not establish that the system was compromised or connected to the July incident.

Current status

The incident is presumed resolved. The latest authoritative incident update, published July 22, said several systems were still offline, the investigation continued and backup processes remained in use. Milford’s website, department pages and payment services were available Aug. 26, but those indirect recovery signals do not establish when every affected system was restored. No later operational-impact notice or authoritative all-clear was identified.

Confidence and uncertainty

Cyber and operational-impact confidence are high because Milford directly confirmed unauthorized activity and documented specific service disruptions. The precise mechanism remains unknown. The public record does not support confirmed ransomware, encryption, extortion or threat-actor attribution.

Data impact is unresolved. Milford has not said whether personal, financial, employee, resident or administrative information was accessed, copied, altered or removed, and no regulator breach notice was identified.

Analytic gaps

The reviewed sources do not establish when the intrusion began, the initial-access vector, exploited vulnerability, compromised account, affected hosts, persistence mechanism, malware family, encryption status, backup impact or whether the exposed Synology system was involved. They also do not identify which systems remained offline July 22, which services had been restored, whether law enforcement was involved, or when full recovery occurred.