Cyber Incident Victim: Meriden
Date:
Mar 2026
Location:
United States of America
Summary
A ransomware group identified as Inc claimed responsibility for a cyberattack on the city of Meriden, Connecticut, which was reported by local officials. The intrusion led to the theft of data and caused significant disruption to municipal services, with recovery efforts ongoing for more than a month after the incident was disclosed.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 17, 2026, city officials in Meriden, Connecticut, reported that a cyberattack had compromised municipal systems. The ransomware group Inc publicly claimed responsibility for the intrusion, stating that they had gained access to the city’s network and exfiltrated data. According to the officials’ announcement, the attack caused significant disruptions to various government services, affecting online portals, internal communications, and possibly public-facing applications. The city acknowledged that the breach had led to the theft of unspecified data, though no further details about the volume or type of information were disclosed at that time. In the immediate aftermath, Meriden’s IT staff began isolating affected systems to prevent further spread of the ransomware.
By March 31, 2026, more than a month after the initial report, the city indicated that restoration efforts were still underway, with services gradually being brought back online as part of the containment and recovery process. Officials noted that the incident had resulted in prolonged outages for certain municipal functions, requiring manual workarounds and extended downtime for residents and employees. The ongoing recovery involved rebuilding compromised servers, restoring data from backups, and implementing additional security monitoring to detect any residual threats. No public statement confirmed whether the ransom demand had been paid or whether any decryption keys had been obtained. The incident remained classified as an active ransomware event with data theft attributed to the Inc group, and Meriden continued to work on fully restoring normal operations.