Cyber Incident Victim: Miller County
Date:
Nov 2020
Location:
United States of America
Summary
A ransomware attack disrupted computer systems serving Miller County, Bowie County, and the cities of Texarkana in both Arkansas and Texas. Suspicious network activity prompted an investigation, revealing the ransomware had been present prior to detection. While the incident involved a data compromise, there was no evidence of personal information being accessed. Critical water services remained operational despite the attack. Recovery efforts included shutting down affected systems, ongoing repairs, and a continuing investigation, though the full scope of the impact was not yet determined.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
A ransomware attack targeting the network serving Bowie County, Miller County, and the Cities of Texarkana, Arkansas and Texarkana, Texas was detected on December 6, 2020, when the Texarkana Water Utility's Information Technology Department observed suspicious network activity. Forensic analysis confirmed the ransomware had infiltrated the network prior to November 26, 2020, though its exact initial intrusion timeline remained undetermined at the time of reporting. The attack caused widespread operational disruptions, forcing the shutdown of computer systems at the Bowie County Courthouse, BiState Justice Building, and other unspecified government agencies. Municipal services across both cities and counties experienced major outages, though water utility operations were specifically confirmed to remain unaffected despite the compromise of supporting IT infrastructure. Officials publicly acknowledged a "data incident" but stated no evidence indicated personal information had been compromised during the attack.
Response efforts focused on containment and recovery, with technicians immediately isolating affected systems to prevent further spread of the ransomware. Repair operations commenced to restore compromised PCs and network infrastructure, though authorities noted the full scope of impacted systems remained undetermined due to the attack's complexity. A joint investigation involving multiple jurisdictions was initiated, with details withheld to preserve investigative integrity. Public communications emphasized ongoing work to resolve outages while maintaining critical services, though no ransomware variant, payment demands, or attribution details were disclosed. The Cities of Texarkana issued formal statements confirming the attack's occurrence and containment measures while directing inquiries to future updates as restoration progressed.