Catawba County

Summary

Catawba County suffered a cyberattack between Sept. 12 and 19, 2025, potentially exposing current and former residents' personal, financial, medical, and insurance information. The county detected unauthorized network activity and did not pay a ransom.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Catawba County, North Carolina, detected unauthorized activity in its computer network on September 19, 2025. The county said the unauthorized access may have occurred between September 12 and September 19. The incident potentially affected information belonging to current and former county residents. The information that may have been disclosed included full names, dates of birth, Social Security numbers, financial account information, medical information, and health insurance information. The county also said it had no evidence that information taken during the incident had been misused and that emergency systems were never compromised.

In response to the incident, Catawba County sent 128,000 letters to people who were possibly affected and to descendants of people who may have been affected. Those notifications identified the types of information that may have been exposed. County Communications and Marketing Strategist Paul Foster said the county did not pay any money to the people who accessed the information. North Carolina law prohibits state and local governments from paying ransoms or communicating with the individuals or organizations responsible for ransomware incidents. Despite the prohibition, the county’s decision not to pay meant that the incident’s costs were not covered through a ransom payment.

The county said all costs associated with the cyberattack were covered by its cybersecurity insurance, except for a $50,000 deductible. It subsequently hardened and enhanced its data security. The county also established a public information page at catawbacountync.gov/cyber-event-info. In addition to notifying potentially affected people and their descendants, the county offered complimentary credit monitoring. It operated a toll-free information line at 866-898-7846, available Monday through Friday from 8 a.m. to 8 p.m., to provide information about the incident and the services available to affected individuals.

As of the October 2, 2026 report, the unauthorized network activity had potentially exposed personal, financial, medical, and health insurance information for current and former residents. The county had notified 128,000 people or descendants of affected people, declined to pay a ransom, maintained that emergency systems had not been compromised, and reported no evidence of misuse of the information taken. The county had also funded the response through cybersecurity insurance, aside from its deductible, and had begun hardening and enhancing its data security after the September 2025 incident.

Sources

Sources available to members: 1 source.