Vicksburg ransomware attack forces Mississippi city offline

The city of Vicksburg, Mississippi, has shut down its computer systems following a ransomware attack, Mayor Willis Thompson told residents on Thursday evening.

Thompson announced the incident in a statement published in the local newspaper. He said the city is investigating the attack and described the shutdown as "temporary." Emergency services have not been affected, but residents cannot currently pay their utility bills through the usual channels.

Vicksburg has more than 20,000 residents and lies about 40 minutes west of Jackson, the state capital.

No shut-offs or late fees during the investigation

To ease concerns about the payment disruption, the mayor said no one's services will be disconnected while the investigation continues. The city will also not issue penalties for late payments.

Thompson later told the Vicksburg Post that the city is working on recovery with the FBI, the Department of Homeland Security (DHS), the federal agency that includes the US government's main civilian cybersecurity body, and other state officials. Private cybersecurity experts are also involved.

Personal data exposure still unclear

The city has not yet determined whether any data was stolen. According to Thompson, finding out if information was compromised is a central part of the investigation.

"One of the top priorities of our investigation is determining whether there was any compromise of personal or confidential information relating to current and/or former customers, contractors, vendors, employees, or affiliated business partners of the City," he said in the statement.

"At this time, the investigation is ongoing, and the City has not reached a final determination regarding what information, if any, may have been accessed or acquired without authorization," he added.

Few other details are available. The city did not respond to questions about whether a ransom was demanded or who is behind the attack. Thompson's statement also made clear that Vicksburg will not share technical information "that could interfere with the investigation, recovery efforts, or the security of City systems."

Not the first ransomware hit in Mississippi

The Vicksburg incident follows a series of ransomware attacks on organizations in the state.

The most serious recent case was the attack on the University of Mississippi Medical Center (UMMC), the largest and most important healthcare organization in Mississippi. UMMC runs the state's only children's hospital, its only Level I trauma center (the highest US designation for trauma care), its only Level IV neonatal intensive care unit, and its only organ transplant programs.

After the attack, the hospital system spent weeks in the dark and needed help from the FBI to recover.

Ransomware gangs also went after a prominent electricity utility in Mississippi last year, and a county in the state was targeted in 2023.

Our Take

Vicksburg fits a familiar pattern. Small and mid-sized local governments run services that residents rely on every day, from utilities to permits, yet they rarely have the security budgets of large cities or private companies. When they are hit, the usual response is to take systems offline, which limits the damage but also halts routine services such as bill payments.

The city's decision to suspend shut-offs and late fees is a sensible step that keeps the outage from becoming a financial burden for residents. Still, the more important question is whether personal data was taken. Many ransomware groups now steal files before encrypting systems and use the threat of publication as extra pressure. Vicksburg has not said whether this happened, and readers should not assume either way until the city completes its review. Recent cases such as the Arizona court system breach show how public bodies can end up exposing residents' information.

The string of incidents in Mississippi, covering a hospital system, an electricity utility, a county and now a city, suggests that public services in the state remain an attractive target. That mirrors broader activity against utilities and other essential services, including ransomware hitting water and telecom providers elsewhere.

It is worth watching whether a ransomware group claims the attack on a leak site, whether Vicksburg later sends data breach notifications, and how long it takes to restore payment systems. Those details will show how serious the incident really was.