Skip to content
DysruptionHub
Sign in Subscribe

West Chester Township email-system intrusion

Summary

West Chester Township logo

West Chester Township took email and other technology offline while responding to a two-phase intrusion in August 2025. A later township account described phased restoration, while PEAR’s alleged data theft remained unverified.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High
Ransomware:
Medium
Attribution:
Low

Attack mechanisms

Data impacts

  • Unknown data impact

    The incident is cyber-related, but available evidence does not establish whether or how data was affected.

Operational impacts

  • Email disruption

    Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Alternate service channel required

    The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.

Extortion indicators

  • Ransom demand

    The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

Incident narrative

Analyst assessment

West Chester Township in Butler County, Ohio, experienced malicious intrusions in August 2025 that affected its central email system. We reported the second episode Aug. 26, following an Aug. 12 episode that officials initially said had been contained.

A later interview with township spokesperson Brianna Wooten described the episodes as a combined intrusion in two phases involving the same group. That supports maintaining one incident. Her statement did not publicly identify the group.

Operational significance

The township’s Aug. 29 notice confirmed that email and other technology remained offline during the investigation and security work. Residents, businesses and partners were directed to telephone, in-person and website alternatives.

The 911 call center and critical public-safety functions were unaffected, and public offices remained open. The communication outage qualifies as operational disruption without implying that township government or emergency response stopped altogether.

Wooten subsequently described phased restoration and a return to operations. The report did not give a precise completion date.

Confidence and uncertainty

Confidence is high in a cyber incident and email disruption because the affected government acknowledged both. PEAR’s reported claim to the first August episode and its alleged theft of 2 terabytes remain allegations.

Comparitech reported that employees received ransom notes and that the township had not verified the alleged theft. This supports moderate confidence in extortion involvement; it does not establish encryption. Actor attribution remains low confidence because a matched claim is not independent confirmation that PEAR conducted the intrusion.

Analytic gaps

The initial access method, complete affected-system inventory, data accessed or taken, final investigation findings, ransom amount and payment outcome remain unestablished. The later account links the two local episodes but does not establish a connection to separate incidents in Middletown or Liberty Township.

Operations are assessed as resolved based on the township spokesperson’s account of systems returning online. Aug. 29, 2025 remains the latest precise observation of continuing impact in the reviewed evidence. The exact recovery date is unknown. The Nov. 30 recovery report is evidence of restoration, not a new disruption date.

Threat actor and claim

pear

Listed as: West ChesterSource: ransomware.liveDiscovered:

Claim details

PEAR claimed West Chester Township (westchesteroh.org) in connection with the first August 2025 intrusion and allegedly took 2 TB. Contemporaneous reporting places the claim by Aug. 15; the aggregator’s later Sept. 14 discovery timestamp is not the attack or original claim publication date. The township confirmed an intrusion but had not verified the alleged theft or publicly attributed it to PEAR. Its later statement links the two phases to the same unnamed group, not independently to PEAR.

Organizations involved

Impacted location

  • West Chester Township, Ohio

    West Chester Township in Butler County is the municipality containing the affected government’s administration. This is an organizational site anchor; 911 and critical public-safety systems remained operational.

    The township government’s jurisdiction supplies the service-area context for disrupted email. This does not assert a township-wide outage of all services or an interruption of emergency response.

    Source

Sources

Township Response to Cybersecurity Incident: How to Reach Us
West Chester Township, OhioPublished: Retrieved:
  • Type: Official Statement
  • Stance: Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

The township said email and other technology remained offline as a precaution. Telephone, in-person and website alternatives remained available; 911 and critical public-safety functions were unaffected.

Butler County communities ramp up cybersecurity as global threats, breaches rise
WCPO / Michael D. Pitman, Journal-NewsPublished: Retrieved:
  • Type: News Report
  • Stance: Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

Township spokesperson Brianna Wooten described the two August incidents as a combined, two-phase intrusion and said technology had been brought back online in phases.

Ransomware group says it hacked West Chester Township, OH
ComparitechRetrieved:
  • Type: News Report
  • Stance: Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

PEAR claimed the first August intrusion and alleged theft of 2 TB. The report describes employees receiving ransom notes, but the township had not verified the alleged theft.

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.