Wise County Sheriff’s Office cyberattack disrupts records access

Analyst assessment

DysruptionHub assesses with high confidence that the Wise County Sheriff’s Office experienced malicious cyber activity that materially disrupted records operations in June 2026. In a June 22 catastrophe notice, the office said all systems had been hit twice by hackers during the preceding week. Staff could not retrieve records or print incoming public-information requests, and logged and saved requests were gone or inaccessible.

The filing narrows both attacks only to the week before June 22; it does not identify either attack date. The evidence confirms malicious cyber activity but not its mechanism. No public source identifies initial access, a compromised account, an exploited vulnerability, malware, encryption, data exfiltration or a responsible threat actor. No ransomware confirmation or ransom demand was found.

Operational significance

The disruption directly affected compliance with the Texas Public Information Act. The office said requests would have to be rebuilt from fulfilled-request records retained in sent email files, indicating loss of normal records access, delayed processing and a manual reconstruction burden. It warned that some missing material might never be retrieved.

The sheriff’s office suspended public-information deadlines from June 22 through June 28. A second catastrophe notice extended the suspension through July 5, showing that the operational effect continued beyond the initial period. The current Texas attorney general register contains no later Wise County Sheriff’s Office extension.

The confirmed impact is administrative and records-related. The public record does not establish whether 911, dispatch, patrol, detention, communications, evidence management or other public-safety functions were disrupted. Those effects cannot be inferred from the broader statement that all systems were hit.

Disclosure posture

The clearest disclosure came through notices filed with the Texas attorney general rather than a detailed public-facing incident update. DysruptionHub’s published report documented the notices, the extension through July 5 and the absence of public answers about ransomware, data theft, attribution and public-safety effects.

The notices acknowledge malicious activity and operational disruption but provide little technical or recovery detail. No later breach notice, affected-data disclosure or forensic conclusion was found. That absence does not establish that no data was accessed; confidentiality and integrity effects remain unresolved.

Current status

The June 22 notice said systems were not fully restored and gave no restoration estimate. The deadline suspension ended July 5, and the sheriff’s current Open Records page accepts requests in person, by mail, by email and through an online form. It also says requests are processed in the order received and completed requests are returned by email.

Those current channels support that public-information intake is available again, but they do not establish full restoration, recovery of the requests described as gone or clearance of the reconstruction backlog. DysruptionHub therefore retains a presumed-resolved status rather than treating the incident as authoritatively resolved.

Confidence and uncertainty

Confidence is high that a cyber incident occurred and disrupted records access and processing because the affected organization described the attacks and effects in an official filing. Confidence is also high that staff faced service delays, restricted public access, a backlog and manual reconstruction work.

Confidence is low regarding permanent data loss. The office said some material might never be retrieved, but public evidence does not establish whether records were deleted, encrypted, corrupted or temporarily inaccessible. Ransomware confidence and threat-actor attribution remain unresolved.

Analytic gaps

The public record does not establish the exact dates of the two attacks, the date of initial access, affected infrastructure, compromise method, recovery method or participation by outside incident-response or law-enforcement partners. It also does not resolve whether personal, criminal-justice, evidentiary, jail, employee or public-record data was accessed, altered, destroyed or exfiltrated.

Further official reporting is needed to determine whether all systems were restored after July 5, whether any records remained permanently unrecoverable, whether the backlog was cleared and whether the incident triggered breach notifications or other regulatory reporting.