Claim details
Comparitech reported that Rhysida claimed the November 2025 Southold attack, demanded 10 bitcoin and threatened to sell purportedly stolen data. Town officials have not confirmed Rhysida or exfiltration.
Town of Southold Cyber Incident
Summary
Southold’s November 2025 ransomware attack disrupted town servers and records processing. Most systems returned by December, but its public records portal remained offline until June 2026. Rhysida later claimed the attack; the town has not confirmed that claim or data theft.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Email disruption
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Our November 2025 report documented Southold’s initial report of a potential cyber incident affecting town servers and email on Nov. 24. In December reporting, Supervisor Al Krupski called it a ransomware attack and said most systems had been restored after nearly two weeks. His acknowledgment establishes ransomware involvement, but the public record does not identify the intrusion method or perpetrator.
Operational significance
Town email, records processing and other computer services were disrupted. Police said 911 and administrative phones kept working, although officers had to write reports by hand. Most town computer systems were restored by early December. The public Laserfiche records portal remained offline until June 16, 2026, when officials said it was available again with some reported slowdowns. The Southold location marks the town government’s service area; it does not imply every facility there lost service.
Threat-actor claim and data uncertainty
Comparitech reported on March 2, 2026, that Rhysida claimed the attack, demanded 10 bitcoin and threatened to sell purportedly stolen data. Town officials have not confirmed Rhysida’s responsibility or the claimed data theft. The claim does not establish exfiltration.
Current status
The town reported most systems restored by December, and officials said the remaining public records portal was accessible in June 2026. The incident is recorded as resolved, while the portal’s reported performance issues and any data impact remain separate uncertainties.
Confidence and uncertainty
Ransomware involvement is supported by the town supervisor’s account to local reporters. The actor claim is unverified. No reviewed official finding establishes initial access, the full scope of affected data, payment or a named perpetrator.
Threat actor and claim
Organizations involved
Town of Southold
Location
Organization type
Critical infrastructure
Impacted location
Sources
Southold, New York, officials said Monday they are investigating a ‘potential cyber incident’ that has disrupted town computer servers, knocked out email and limited records processing but has not affected 911 or police phone lines.
See something that needs correction?
Signed-in members can report an error, update, or missing source.