Cyber Incident Victim: DuPage County
Date:
Apr 2025
Location:
United States of America
Summary
DuPage County confirmed a ransomware attack that affected the Sheriff’s Office, the 18th Judicial Circuit Court, and the Circuit Court Clerk’s Office, prompting those systems to be taken offline. Officials said jail operations and public safety were unaffected, in‑person court hearings continued as scheduled, and chancery sales in the Sheriff’s Office were canceled while the FBI and Secret Service were engaged in the investigation.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
At approximately 2:30 AM on April 28, 2025, DuPage County officials became aware of a cyber incident affecting the Sheriff’s Office, the 18th Judicial Circuit Court, and the Circuit Court Clerk’s Office. Later that afternoon, the county confirmed that the incident was a ransomware attack targeting those same offices. Systems associated with the Sheriff’s Office, the circuit court, and the clerk’s office were taken offline as part of the response. The DuPage County Court House, located at 505 N. County Farm Road in Wheaton, Illinois, houses the affected judicial and law‑enforcement functions. The first public statement was issued at 12:27 PM on April 28, 2025, attributable to Chief Judge Bonnie Wheaton, Circuit Court Clerk Candice Adams, and Sheriff Jim Mendrick. That statement noted an outage in the Sheriff’s Office and the County Courthouse while emphasizing that all other county operations remained unaffected. It also clarified that the outage had no impact on jail operations or on public safety. A follow‑up statement was released at 7:04 PM the same day, again attributed to the three officials, in which the county affirmed that it had been the target of a ransomware attack. Both statements were submitted by Evan Shields, the Communications Manager for the DuPage County Board.
The county reported that in‑person court hearings were scheduled to proceed the following morning and that in‑person court operations were described as minimally impacted and expected to continue as scheduled. Chancery sales conducted by the Sheriff’s Office were canceled for the week. Officials confirmed that the jail continued to operate normally and that there was no effect on public safety services. In response to the incident, DuPage County contacted the Federal Bureau of Investigation and the United States Secret Service to assist with the investigation. The statements indicated that the matter remained under active investigation and that further information would be shared as it became available. Because the investigation was open, the county declared that it would provide no additional comment at that time. The narrative of the incident is limited to the facts disclosed in the official statements and the accompanying contextual details.