MalwareGovernmentGovernmentRansomwareData EncryptedCustomer Data InvolvedFinancial accountIdentity (basic)Government IDMediumContained

Town of Vienna

bd_727a7c30ad84168e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 14, 2025

Filed

Feb 3, 2026

To disclose

25 weeks

Affected

4state residents only

Linked

2 filings

Confidence

64%

Full breach record for Town of Vienna →

The Town of Vienna experienced a ransomware attack on August 11, 2025, discovered on August 14, 2025. Malicious actors gained network access and encrypted portions of the network. Access was terminated upon detection. Potential exposure includes names, Social Security numbers, passport numbers, and financial account information. The Town engaged cybersecurity experts, notified the FBI and Virginia Fusion Center, and implemented additional security safeguards.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d25 weeks discovery → filing

Incident timeline

undetected · 3 days

discovery → filing · 25 weeks / 173 days

Aug 11, 2025

Begins

Aug 14, 2025

Discovered

Feb 3, 2026

Filed

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Maine State AGbd_d8709f150b75ec362025-09-09 · +147dCandidate

Name: Town of Vienna
norm: town of vienna

Name: Town of Vienna
norm: town of vienna
Industry: Governmentllm

Discovered: Aug 14, 2025
Breach occurred: Aug 11, 2025
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 4state-resident count only
Data types: Financial accountIdentity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the attack to the Federal Bureau of Investigation (FBI) Cyber DivisionReported the attack to the Virginia Fusion Center

During the incident: Engaged third-party cybersecurity experts to investigate the incident
Secured personal information and protected the Town’s network from compromise
Terminated malicious actors’ network access
Reported the attack to the Federal Bureau of Investigation (FBI) Cyber Division
Reported the attack to the Virginia Fusion Center
Engaged a leading strategic service provider to monitor cybersecurity systems
Reviewed system’s architecture
Implemented stronger policies to prevent future attacks
Changes made: Implemented additional security measures designed to further protect the privacy of staff and partners
Reviewed policies and procedures relating to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(173 days from discovery to filing)
Compliance flags: MA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Maine State AGSep 9 · first

Massachusetts State AG+147d · this page

Pattern: first filing Sep 9 (ME), last Feb 3 (MA) — a 147-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-154-the-town-of-vienna/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 3, 2026
Raw hash: 1e0030d0d7981d5177e64cb9ff819ebcacdb97feec307364cebf06d6bebb97d1

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityTown of Vienna

Victim entityTown of Vienna

Incidentdiscovered Aug 14, 2025

Stated responseEngaged third-party cybersecurity experts to investigate the incident

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov