Town of Orange outage and LockBit claim

Analyst assessment

Our April 22 report documented a February technology outage that closed Town Hall, the Public Works office and the Community Development office in Orange, Virginia, for parts of three days. The town’s own Facebook updates described the event only as a technology outage. On Feb. 20, Town Hall reopened but could accept only cash or checks while the outage was still being resolved.

LockBit listed townoforangeva.gov on its leak site March 5, about two weeks after the outage. A stable victim claim is concrete external cyber evidence, so DysruptionHub assesses cyber involvement as confirmed. That finding does not establish that LockBit’s allegations are true, that ransomware caused the February outage or that the two events were connected. Ransomware and LockBit attribution remain low confidence because the town has not confirmed a cyberattack, ransomware, data theft, a ransom demand or the claim itself.

Operational significance

The disruption affected core municipal administration rather than a single public website. Town Hall, Public Works and Community Development offices were closed from Wednesday afternoon through Friday at 1 p.m., temporarily limiting in-person municipal access. After Town Hall reopened, the town still could not process its normal range of payments and accepted only cash or checks until the technology outage was fully resolved.

The Town of Orange’s department directory shows that its municipal departments support utility billing, taxes and fees, planning and permitting, public works, law enforcement, elections and other local-government functions. The public record does not establish that all of those services were disrupted, nor does it establish an interruption to police, water, sewer, emergency response or other critical operations beyond the documented office closures and payment restriction.

Disclosure posture

The Town of Orange publicly acknowledged the operational disruption but characterized it only as a technology outage. In response to DysruptionHub, town officials did not answer questions before publication about whether the outage stemmed from a cybersecurity incident, whether the LockBit claim was legitimate, what systems were affected or whether data was compromised. The absence of a public cyber confirmation leaves the connection between the outage and claim unresolved; it does not establish concealment or misrepresentation.

Current status

Town Hall reopened Feb. 20 with a temporary cash-or-check-only restriction while the outage was still being resolved. No later public restoration notice establishes a precise final recovery date. Because the last documented operational impact is more than 30 days old, the incident is assessed as presumed resolved rather than positively resolved.

Confidence and uncertainty

Confidence is high that a material technology outage occurred because the Town of Orange itself announced the closures and restricted payment capability. Overall incident confidence is medium because both the outage and the stable LockBit listing are documented, but their relationship remains uncertain.

The LockBit claim does not establish that data was stolen or published. Our reporting documented that the leak-site page displayed the town’s domain and a leaked-data banner, but the public evidence does not independently validate the contents of any allegedly stolen material. The claim supports low-confidence ransomware and actor assessments, not confirmed data compromise.

Analytic gaps

The public record does not establish the initial access vector, compromised account or host, cyber mechanism, malware family, encryption activity, affected systems, attacker dwell time, data-access or exfiltration scope, ransom demand, payment status, restoration method or final recovery date. It also remains unresolved whether the LockBit listing represented a genuine compromise of the Town of Orange, a recycled or inaccurate claim, or activity unrelated to the February technology outage.