Cyber Incident Victim: Town of Salem
Date:
Oct 2020
Location:
United States of America
Summary
A New Hampshire municipality experienced a sophisticated ransomware attack that disrupted operations by forcing systems offline. Attackers successfully accessed internal networks during the incident, potentially compromising sensitive information. Town officials confirmed the unauthorized system access after detecting the breach, though the full scope of data exposure remained unclear. The incident caused sustained operational disruptions as authorities worked to restore services and investigate the intrusion.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On October 21, 2020, at approximately 3:15 a.m., the Town of Salem, New Hampshire, experienced a cybersecurity incident characterized by town officials as a sophisticated ransomware attack. The breach forced immediate disruption to municipal operations as town systems were taken offline to contain the threat. Town Manager Chris Dillon publicly confirmed the attack in an official statement, noting the malicious activity targeted internal networks. Initial assessments indicated unauthorized actors successfully infiltrated town infrastructure, deploying ransomware to compromise systems. The attack prompted an ongoing investigation to determine the full scope of compromise and operational consequences. No specific details regarding the ransomware variant, initial attack vector, or precise systems affected were disclosed in the initial public reporting.
By October 21, officials had confirmed attackers accessed internal systems beyond deploying ransomware, raising concerns about potential data theft. The town remained offline indefinitely following the breach, indicating sustained operational disruption to municipal services and internal communications. Dillon’s statement emphasized the sophistication of the attack but did not specify whether ransom demands were issued or if data was exfiltrated. Recovery efforts focused on securing systems and assessing data exposure, though no timeline for restoration was provided. The incident underscored persistent vulnerabilities in local government infrastructure, with prolonged downtime reflecting the severity of the compromise and the complexity of remediation.