Ulster ransomware disrupts town systems and records

Analyst assessment

DysruptionHub assesses with high confidence that a ransomware attack disrupted the Town of Ulster’s municipal information systems in September 2024. The town’s 2024 financial statements place unauthorized entry on Sept. 10 and discovery on Sept. 11, when officials disconnected the network. The town confirmed ransomware deployment and later reported that its investigation found no access to or theft of personally identifiable information.

The attack impaired administrative systems and left employees rebuilding records from older backups and paper files. Contemporary reporting quoted Supervisor James Quigley describing a rapid shutdown, backup-server recovery and manual procedures. The separate police and court networks were not reported penetrated; the police chief subsequently described a brief records-management interruption during the response. Town email and the public website remained available.

Operational significance

Sept. 19 board minutes document paper building reviews, unavailable highway work-order databases and a disabled fleet-fueling system that required purchases at retail stations. Staff processed payroll and vendor payments through workarounds and reconstructed water and sewer billing for about 2,500 accounts. Restoring applications did not restore every recent record. Oct. 3 minutes show the fueling system functioning again while financial, billing and document recovery continued.

The effects persisted after the initial network recovery. January reporting described continued employee-record reconstruction, missing documents and water bills with incorrect account details. The Jan. 16 minutes also record a delayed financial-software upgrade. On Feb. 20, the building department was still processing five years of electronic records lost in the attack. These are administrative and utility-billing effects; the reviewed evidence does not establish interruption of drinking-water delivery or wastewater treatment.

Confidence and uncertainty

Confidence is high in malicious cyber involvement, ransomware deployment and material operational disruption. Attribution remains unresolved. The town’s reported finding about personal information does not negate the loss of access to operational records. Its financial statements say communications with the attacker did not result in a ransom payment and that insurance covered recovery and restoration expenses apart from the deductible. The record does not establish an exact demand, payment instructions or a file-level encryption inventory.

The earliest verified public cyber acknowledgment in the reviewed material is Quigley’s Sept. 18 interview. Sept. 19 minutes refer to earlier Daily Freeman coverage, but its original chronology could not be verified. The sequence between the first outside characterization and the town’s first cyber-specific statement therefore remains unresolved. Private notifications to government agencies are distinct from public disclosure.

Analytic gaps

The documented operational status is presumed resolved, with no verified exact end date. On April 17, the supervisor still attributed delayed financial reporting to the attack. On May 1, the comptroller said year-end closeout and submission of audit materials were complete and expected monthly reporting to return to schedule. That progress does not establish when every missing record or billing problem was resolved.

The initial-access method, exploited vulnerability or credentials, malware family, attacker identity, complete damaged-data scope and final operational recovery date remain unknown. No matching native ransomware-claim lead was returned for the town’s name or domain. That negative search does not establish that no claim exists.