Abilene Releases Full Update on April Ransomware Attack

ABILENE, TX — City officials have released new details about the ransomware attack that struck Abilene’s network on April 18, confirming that hackers encrypted and deleted data before demanding payment for its return.

According to the update, the breach was discovered around 4 a.m., prompting the City’s IT department to shut down the network within hours to prevent further intrusion. Troy Swanson, Abilene’s Director of Information Technology, said the attackers accessed administrative credentials and attempted to disable antivirus protections before being cut off.

“The City suffered a ransomware attack,” Swanson said. “They encrypted data and deleted data off our servers.”

The Russian-linked group Qilin has claimed responsibility for the attack and told the City it had stolen 477 gigabytes of data. While Abilene did communicate with the group to identify what information may have been taken, officials said they refused to pay the ransom.

“We’re also not going to bow down to a criminal organization,” said Mike Perry, Director of the City’s Office of Professional Standards. He added, “You’re still dealing with thieves, and is there such a thing as an honorable thief?”

Perry said there is no current indication that stolen information has been published or misused. The exact contents of the stolen data remain under investigation, though the amount appears small compared to the city’s overall network.

In response, the City has begun replacing its entire digital infrastructure, including servers, storage systems, and employee devices. Temporary computers have already been deployed to maintain essential operations, and permanent replacements are being distributed.

Swanson said that while stopgap measures were used in many cases, the city has been relatively successful in restoring time-sensitive operations.

The City expects to be fully operational within the next few months and is offering privacy protection services to affected employees. Officials are encouraging residents to monitor their accounts, update passwords, and consider freezing their credit reports as a precaution.

City leaders emphasized that critical services, including police, fire, water, and waste management, continued uninterrupted during the response.

You can find the full statement here.