City of Cleveland confirms ransomware attack that closed City Hall for two weeks

The City of Cleveland confirmed on 14 June 2024 that the cyber incident which had forced City Hall and its satellite offices to close was a ransomware attack. Officials said anomalies were detected in the city's IT environment on the evening of Saturday 8 June, and that systems were shut down the following day to limit damage and allow an investigation.

City Hall closed to the public on Monday 10 June and remained shut for a second week. Employees were still required to report for work, and the city distributed wireless hotspots because building internet was unavailable. Disrupted services included the processing of building permits and vital records, although residents could still file some applications online.

Officials said essential services were unaffected. Emergency response, waste collection, water and power utilities, recreation centres and the city airport continued to operate.

A city spokesperson said the threat had been identified and contained, but that the nature of the attack remained under investigation. Cleveland declined to say which internal systems were affected, what data the attackers may have accessed, or whether a ransom had been demanded or paid, and gave no date for reopening City Hall. The FBI and the Ohio National Guard's Cyber Reserve Unit assisted city IT staff with the response.