Ransomware attack disrupts services for the city of Durant, Oklahoma

The city of Durant, Oklahoma, a community of more than 20,000 people, said it was hit by a ransomware attack on 1 June 2025 and acknowledged the incident publicly the following day. City staff began working with law enforcement and outside cybersecurity specialists, and the Secret Service and FBI were reported to be investigating.

Digital and credit card payment systems were the most visible casualty, along with some administrative programs. City Hall temporarily accepted only cash and checks for bill payments and set up a toll-free line for residents with account numbers. The police department reported network outages at its communications center but said 911 emergency service continued to operate. Payment systems were restored on 9 June.

In its early statements the city said it was not aware of any ransom having been demanded and had no indication that residents' personal information had been compromised. That picture changed later in the month. On 17 June the Inc ransomware group claimed the attack on its leak site, said it had taken 800GB of data including passport information, addresses and telephone numbers belonging to hundreds of people, and gave the city 48 hours to pay before it would sell or release the material.

Durant did not verify the group's claims and did not say publicly whether a ransom was paid.