City of Cleveland

Summary

A cyber incident prompted the closure of Cleveland City Hall for multiple days, with officials confirming system disruptions but no compromise of tax documents. The city disabled several affected systems as a precaution, though emergency services remained operational throughout the event. Mayor Justin Bibb declined to disclose specific details regarding the incident’s scope or origin during public statements.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

A cyber incident impacting Cleveland City Hall operations prompted officials to close the facility for two consecutive days, beginning Monday, June 10, 2024, and extending through Tuesday, June 11. City authorities publicly acknowledged the incident on Sunday, June 8, though they did not disclose technical details regarding its origin, intrusion methods, or specific systems initially compromised. During a press conference held Monday, Mayor Justin Bibb confirmed the event as a "cyber incident" but declined to elaborate on its scope, nature, or potential threat actors involved. The city implemented immediate containment measures by proactively shutting down multiple affected IT systems to prevent further spread or damage. Critical emergency service systems, including those supporting police, fire, and medical response, remained operational throughout the incident, indicating segmentation or isolation of non-essential networks.

The city maintained public services for tax-related functions, with Mayor Bibb explicitly stating no taxpayer documents or sensitive financial data were accessed or exfiltrated. No evidence suggested ransomware deployment or public data leaks during the initial response phase. Operational disruptions were confined to non-emergency municipal services requiring access to the disabled systems, necessitating the physical closure of City Hall. The incident marked at least the second consecutive day of significant operational downtime, reflecting the time required for forensic analysis and system restoration. City officials provided no estimated restoration timeline or additional technical specifics beyond confirming the containment strategy and continuity of essential services.

Sources

Sources available to members: 1 source.