Clearfield County

Summary

A cyberattack compromised all servers and approximately 15% of workstations at Clearfield County, significantly disrupting operations. Upon detecting the malware activity, county officials initiated an investigation to restore systems and evaluate the scope of the incident, though specific operational impacts or data compromise details were not publicly disclosed in the initial response. The county emphasized efforts to mitigate the attack and resume normal functions.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

A cyberattack targeting Clearfield County, Pennsylvania, was discovered over the weekend of January 8-10, 2021, compromising the entirety of the county's server infrastructure and approximately 15% of its endpoint computers. County officials detected malware activity infiltrating their network systems during this period, prompting immediate response measures. The Board of Commissioners—comprising Chairman John A. Sobel, Tony Scotto, and Dave Glass—formally acknowledged the incident in a public statement released on Tuesday, January 10, confirming the disruption to county operations. Initial forensic analysis indicated widespread infection across critical systems, though the specific malware variant and initial attack vector remained unspecified in public disclosures.

County administrators initiated containment protocols upon identifying the compromise, prioritizing investigation of the incident's scope and restoration of essential services. The coordinated response focused on assessing operational impacts while working to isolate affected systems and prevent further propagation of the malware. No details regarding data exfiltration, ransom demands, or specific service outages were disclosed in the initial public reporting. The commissioners' statement emphasized ongoing efforts to determine the full consequences of the breach while maintaining transparency about recovery progress. Restoration work continued systematically across compromised servers and workstations following the containment phase. The incident represented a significant operational disruption given the proportion of infected systems within the county's digital infrastructure.

Sources

Sources available to members: 1 source.