City of Edcouch

Summary

A hacker infiltrated the city of Edcouch's systems, deploying ransomware that threatened to erase all municipal data unless a $40,000 Bitcoin payment was made. The attack compromised sensitive information from the water department and financial operations, while also exfiltrating personal data belonging to over 3,000 residents. The incident occurred shortly after the arrest of the former city manager for alleged water meter tampering, though no direct connection was specified. Homeland Security initiated an investigation into the breach, which targeted critical infrastructure and resident records.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In June 2019, the City of Edcouch, Texas, experienced a ransomware attack in which a hacker infiltrated municipal systems and issued a threat to erase all city data unless officials paid a $40,000 ransom in Bitcoin. The attack compromised sensitive information from the water department and city financial records, disrupting critical municipal operations. This incident occurred shortly after the arrest of Edcouch’s former city manager on unrelated charges of tampering with water meters, though no direct connection between the arrest and the cyberattack was established in available reports. The attacker explicitly demanded cryptocurrency payment as a condition for restoring access to the encrypted data, leveraging the potential destruction of vital records to pressure city officials. Municipal services faced operational uncertainty as staff assessed the extent of system compromise and data integrity risks.

The breach resulted in the confirmed theft of personal information belonging to more than 3,000 residents, escalating concerns about identity theft and privacy violations. In response, Edcouch officials engaged the U.S. Department of Homeland Security to investigate the cyberattack’s origin, impact, and perpetrator. No public disclosure indicated whether the ransom was paid or whether data recovery efforts succeeded. The incident exposed vulnerabilities in the city’s digital infrastructure during a period of administrative turmoil following the former manager’s arrest. Recovery efforts focused on securing compromised systems and assessing the full scope of resident data exposure while federal investigators pursued forensic analysis.

Sources

Sources available to members: 1 source.