A September 2025 cyberattack prompted Waxhaw, North Carolina, to shut down its network and send employees home while town services and emergency response generally continued. Qilin later claimed access to town files, but the claim does not establish confirmed theft or attribution.
Unauthorized access to systems, accounts, networks, or data.
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Internal or external network connectivity was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Employees were sent home, placed on administrative leave, furloughed, or otherwise removed from normal duties because of the incident.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The Town of Waxhaw, North Carolina, experienced a confirmed cyber intrusion and an operational network interruption in September 2025. The town’s Sept. 14 disclosure confirmed unauthorized server access after irregularities were discovered Sept. 12; later local reporting established that the network was shut down and employees were sent home.
We reported Sept. 15, that the town was restoring systems with outside assistance. A later claim report identified Qilin as claiming responsibility for access to municipal procurement and contract files. The claim is relevant to the incident but does not independently establish the actor’s responsibility, successful data theft or ransomware deployment.
The communications director told WSOC-TV that staff returned Sept. 15 with laptops to be checked while the town rebuilt its network. That is concrete disruption to internal municipal work even though residents could generally obtain town services and municipal operating hours continued.
The town’s own disclosure said emergency and life-safety services remained operational throughout. Contingency arrangements supported public business while recovery proceeded; the evidence does not support describing a townwide emergency-service outage.
Confidence is high in cyber involvement and internal interruption because the town acknowledged unauthorized access and local reporting documented the network shutdown and staff displacement. Ransomware-related extortion is a possibility supported by the Qilin claim, but confidence is medium because no reviewed victim statement confirms encryption or extortion. Confidence in attributing the intrusion to Qilin is low because the named link rests on claim reporting.
The town’s initial personal-information statement was limited to a lack of confirmation that such data had been taken. It does not establish the safety of all information. The later allegation concerns procurement and contract material; neither its authenticity nor its full scope was independently verified.
The reviewed evidence does not establish the entry point, data-acquisition result, affected-server count, ransom amount or payment. The original alleged leak material was not independently examined. A group’s claim and a confirmed intrusion are separate findings, and the available evidence does not close the gap between them.
Network rebuilding was still described Sept. 15, 2025, the latest specific operational-impact observation located. No authoritative full-restoration date was found through Oct. 23, 2026, so operations are presumed resolved based on elapsed time. Later claim reporting does not establish a new or continuing outage.
Qilin claimed the Town of Waxhaw and alleged access to municipal procurement and contract files. Ransomware.live lead d2F4aGF3LmNvbUBxaWxpbg matches the official domain and North Carolina identity. DeXpose reports a Sept.25,2025 claim date, but the original posting timestamp was not verified; published_at remains null and discovered_at is preserved separately. The claim does not verify file authenticity, exfiltration, encryption or attribution.
Retains the municipality anchor for affected town government facilities, including staff returning to town hall after the network shutdown. A separate municipal service-area relationship records government jurisdiction.
Waxhaw municipal government reported internal network disruption and possible impacts to public business within its town service jurisdiction. Emergency services continued; the area does not imply every resident or facility lost service.
We reported the town’s Sept.12 network incident, outside response assistance and ongoing restoration.
The town confirmed unauthorized server access and recovery work, while emergency services continued and personal-information theft remained unconfirmed.
The communications director said the network was shut down and employees sent home, with network rebuilding continuing as staff returned.
The report describes Qilin’s Sept.25 claim concerning the town’s procurement and contract files; the allegation remains unverified.
Signed-in members can report an error, update, or missing source.
