City of Denton

Summary

A ransomware attack on BridgePay Network Solutions, a third-party payment gateway provider, caused widespread outages of online credit card payment processing for hundreds of municipalities and organizations across the United States. The incident began when the company experienced degraded performance across core systems, including its gateway API, virtual terminals, and hosted payment pages, which escalated into a full system outage that BridgePay confirmed was ransomware. The attack disrupted services in numerous jurisdictions, including the city of Denton, Texas, as well as other Texas cities, Florida utilities, and entities in Michigan and Wisconsin, with some cities advising residents to pay bills in person. BridgePay reported that initial forensic findings indicated no payment card data was compromised and any files potentially accessed were encrypted, while the company worked with the FBI, U.S. Secret Service, and external specialists on investigation and recovery.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On February 6, 2026, BridgePay Network Solutions, a Florida-based payment gateway provider, experienced a ransomware attack that triggered a system-wide service disruption across its platform. Early warning signs appeared around 3:29 a.m. when monitoring detected degraded performance across multiple services, beginning with the Gateway.Itstgate.com virtual terminal, reporting, and API systems. The intermittent service degradation escalated into a full system outage, affecting core production systems including the BridgePay Gateway API (BridgeComm), PayGuardian Cloud API, MyBridgePay virtual terminal and reporting, hosted payment pages, and PathwayLink gateway and boarding portals. Within hours of the initial disruption, BridgePay disclosed the incident was cybersecurity-related and later confirmed that ransomware was the cause. The company engaged federal law enforcement, including the FBI and U.S. Secret Service, along with external forensic and recovery teams to investigate the attack and restore services.

BridgePay issued a series of security alerts beginning February 6, describing the incident as a nationwide service disruption affecting hundreds of municipalities and organizations across the United States. Initial forensic findings indicated that no payment card data had been compromised, and any files that may have been accessed by the attackers were encrypted. The company stated there was "no evidence of usable data exposure" at the time of disclosure. The specific ransomware group responsible had not been publicly identified. BridgePay communicated that recovery would likely be a lengthy process, noting it could not provide a definitive timeline for full restoration but promised regular updates on the recovery process. The company committed to working with urgency and diligence to restore systems and services in a secure and responsible manner, emphasizing its priority of protecting customers, partners, and operations.

The ripple effects of the BridgePay outage extended across multiple sectors and jurisdictions. Several U.S. merchants and organizations notified customers they could only accept cash due to the nationwide card-processing outage. A restaurant reported that its "credit card processing company had a cyber security breach" and that card payments were unavailable nationwide. Other affected organizations included Lightspeed Commerce, ThriftTrac, and the City of Frisco, Texas. The City of Palm Bay, Florida, issued a warning on February 6 indicating that its online billing payment portal was unavailable due to the BridgePay outage, directing customers to make utility payments by cash, card, or check in person or, in limited cases, by calling the office.

Local governments across multiple states reported significant disruptions to their payment processing capabilities. In Texas, a trio of North Texas cities—Denton, Coppell, and Frisco—reported outages related to the BridgePay incident. Two Texas water utilities, Bryan and San Angelo, also experienced service interruptions. Outside Texas, outages hit Grand Traverse County, Michigan, a municipal campground reservation system in Wisconsin, and a utility in Palm Bay, Florida. Wichita, Kansas, initially faced disruptions but managed to restore service by February 11 when its integrating vendor found a workaround to circumvent BridgePay while the vendor's system remained down. The breadth of affected entities demonstrates how BridgePay's role as a back-end payment gateway integrated into various billing systems allowed the outage to cascade through multiple jurisdictions that use the platform to process transactions.

The City of Marietta, Georgia, was among the municipalities impacted by the BridgePay ransomware attack, experiencing disruptions to its online credit card payment processing. The city's spokesperson, Rachel Langelotti, explained that the temporary disruption resulted from the nationwide ransomware attack on BridgePay Network Solutions, one of the city's online payment gateway providers. Marietta officials stated they were actively working to implement a secure alternative payment solution so online business license payments could resume. The city planned to restore select online services once the alternative method was in place, with business license payments for excise taxes—including liquor, hotel and motel, and auto rental—identified as the first services to be brought back online. In the interim, residents needing to make credit card payments for business licenses were directed to do so in person at City Hall in the Business License Office, located on the first floor at 205 Lawrence Street. The attack on February 6 impacted payment services for hundreds of municipalities across the United States, with BridgePay cooperating with federal authorities and recovery specialists as the incident was reviewed.

Sources

Sources available to members: 6 sources.