Wood County
Wood County ransomware disrupts dispatch and records systems
Summary
Ransomware disrupted Wood County, Ohio, dispatch, jail and records systems in December 2024. The county reported a $1.5 million payment, later restored services and notified people whose information was affected.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Dispatch disruption
Dispatch, routing, assignment, coordination, or response-management functions were unavailable or materially impaired.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Downstream organization impact
The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.
Extortion indicators
-
Ransom demand
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
-
Payment reported
A source reported that the victim, insurer, intermediary, or another party made a ransom or extortion payment.
Incident narrative
What happened
Wood County, Ohio, detected ransomware on its government network Dec. 9, 2024, after computers began malfunctioning. The county brought in outside cybersecurity and forensic specialists and contacted law enforcement, according to its initial announcement reported by BG Independent News.
Operational effects
The incident affected the sheriff’s computer-aided dispatch and records systems, jail operations, road deputies and the civil division working with courts. Dispatchers and jail staff used paper records, and dispatchers later moved to a shared spreadsheet. Bowling Green police also lost access to some historical information through the county system.
County office phones and 911 calls continued to be answered. Officials said emergency response continued without delays; the disruption affected supporting technology and workflows rather than stopping emergency services.
Payment and recovery
The commissioners announced Dec. 23 that the county had negotiated and paid $1.5 million. The money came from reserves. Many systems were operational, but restoration remained underway.
Some connected police departments still lacked full functionality Dec. 26. Prosecuting Attorney Paul Dobson said insurance covered outside experts; that does not establish that insurance reimbursed the ransom.
Dobson said Jan. 24, 2025, that county technology operations and public services were back to normal. The exact date when every affected system returned to service remains unclear.
Personal information and unresolved details
In a Feb. 25 notice, the commissioners confirmed that the incident involved personal information maintained by the county and offered affected recipients two years of identity monitoring. They said they were unaware of misuse at the time.
The reviewed sources do not establish the attacker’s identity, the initial entry method or a final count of affected people. The county’s early statements about investigating data compromise should be read alongside the subsequent notification.
Organizations involved
Impacted locations
Bowling Green, Ohio
Bowling Green contains the county government’s administrative offices at One Courthouse Square. County network and connected police records systems were disrupted. This physical site anchor is separate from the county administrative service area and does not imply a citywide outage.
Wood County, Ohio
County government IT, dispatch-support and records workflows were disrupted within the affected government’s administrative remit. Emergency calls continued to be answered; this county area relationship does not establish universal service loss.
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.