Analyst assessment
Wayne County, Michigan, experienced a cyberattack on Oct. 2, 2024. Its spokesperson acknowledged a cyber incident affecting internal systems in WXYZ’s initial report, while an unnamed source described a financial demand. The initial intrusion time remains unknown.
The ransomware assessment has support beyond that anonymous account. In WXYZ’s Oct. 3 follow-up, County Commission Chair Alisha Bell said some internal files had been encrypted. Interlock later listed the county, but a listing does not independently establish who deployed the malware or substantiate every theft allegation.
Operational significance
Online tax payments were unavailable, although in-person payment continued. The Register of Deeds closed early, limiting real-estate recording and property-record access. WXYZ also reported disruption to jail bonding and attorney-client visit scheduling. County office websites were unavailable, while the prosecutor later said its office remained open and the Third Circuit Court initially reported normal business.
The effects varied by institution. The Record’s direct inquiries found Detroit city systems unaffected and the probate court functioning. The county used backup processes, and its commission held an in-person meeting when Zoom was unavailable. These findings establish impaired public services without supporting a shutdown of all local government or the entire court system.
A Dec. 18, 2024, county court filing describes lost access to jail databases and electronic court communications, requiring paper records and manual reconstruction for electronic-monitoring release processing. The county said most electronic systems were accessible by Oct. 15 and unusual cyber-related tether delays had ended by its December filing. This was a narrow recovery statement about tether processing, not an all-clear for every county service. A March 25, 2026, federal court opinion also describes the database interruption and paper tracking of court dates and orders. Its decision for the defendants in the over-detention lawsuit did not erase those operational effects; release delays also involved other causes.
The county commission’s June 5, 2025, journal records approval of an amendment raising the limit on a legal-services agreement for the October 2024 cyber incident from $35,000 to $250,000. This was an authorized contract maximum, with no evidence that the full amount had been spent. The agreement concerned legal advice and analysis; its term does not establish a continuing service outage.
Confidence and uncertainty
Confidence in the cyber incident and material disruption is high. Named county officials acknowledged the event and encryption, supporting high ransomware confidence. BleepingComputer’s November reporting identifies Wayne County among Interlock’s claimed victims; attribution remains low confidence, and the record does not establish the initial access method, verified exfiltration scope or a payment outcome.
WDIV’s Oct. 22 reporting presents a mixed recovery picture: the sheriff said computers were restored, while jail operations still faced recovery problems and staffing constraints. Restoration of computers does not prove that all service backlogs had cleared. Later records show additional recovery work. Detroit Wayne Integrated Health Network’s February 2025 committee packet describes a cyberattack on the jail management system during October–December 2024 and says some data may not have been captured. Its April 9, 2025, packet includes a March report stating that NaphCare could not bill jail bed-days after an attack affected the jail management and TechCare systems. Manual data entry remained underway, with a June 30 target for completing the work. That target is not proof of completion. A later report for May 2025, included in the July 9 committee packet, said all outstanding jail mental-health claims had been entered into the system. This provides a recovery milestone for that backlog, without establishing an exact completion day or recovery of every county service. These records do not establish a separate intrusion into NaphCare.
Analytic gaps
The timing of the first intrusion and the extent of affected systems remain uncertain. The earliest reviewed Oct. 2 report contains both external cyber characterization and a quoted county acknowledgment; their publication order cannot be separated. The available evidence does not resolve that disclosure sequence. The county’s own operational statements document service disruption.
Interlock tracker entries discovered in October 2024 and March 2025 contain similar allegations about the same county and domain. The later discovery is not evidence of a second attack. Original claim publication times, the extent of any stolen information and the point when all residual operational problems ended remain unresolved. The March 2025 report dates continuing data-entry work only to a month; the packet’s meeting date does not supply an exact date for that work. The incident remains presumed resolved, with no verified end date. Unrelated jail staffing and opening problems should not automatically be attributed to the cyberattack.
