Cyber Incident Victim: Hamilton County Sheriff's Office
Date:
Apr 2025
Location:
United States of America
Summary
The Hamilton County Sheriff's Office experienceda cyber‑ransomware attack that disrupted internal and external systems. The office enlisted an external cyber defense firm to investigate the breach and begin restoring services. Public‑facing applications have been brought back online, while IT staff continue to work on returning the remaining internal systems to full operation, with completion expected soon. The sheriff has pledged to provide further details as the investigation progresses.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On the morning ofApril 14, 2025, the Hamilton County Sheriff's Office experienced a cyber‑ransomware event that affected its internal and external systems. The incident prompted the office to initiate its response procedures. As a result of the event, normal operations across several systems were disrupted. Public‑accessible programs were among those impacted, preventing routine access until they could be restored. The sheriff’s office characterized the incident as a ransomware‑type cyber attack, though no further technical details were provided at that time.
In response, the Hamilton County Sheriff's Office began working methodically and diligently with an external cyber defense firm to preserve evidence and examine the ransomware event. The joint effort focused on systematically restoring service to all impacted internal and external systems. By the time of the sheriff’s update on April 14, 2025, all publicly accessible programs had been returned to operational status. Internal software systems were partially restored, with the remaining few expected to be back online later in the week. The sheriff emphasized the office’s commitment to transparency and indicated that additional information about the incident would be shared later in the week. At the time of the update, no further specifics were available.