MalwareGovernmentGovernmentRansomwarePhishingData ExfiltratedData EncryptedData PublishedCustomer Data InvolvedIdentity (basic)Government IDMediumActive

City of La Vergne

bd_ce3cdb0643361e3c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 17, 2025

Filed

Jun 26, 2026

To disclose

36 weeks

Affected

14state residents only

Linked

6 filings

Confidence

66%

Full breach record for City of La Vergne →

City of La Vergne, Tennessee, notified Massachusetts residents of a ransomware attack discovered on October 17, 2025. Criminal actors encrypted the City's network, accessed PII (names, SSNs, driver's license numbers), and published stolen data online. The City engaged the FBI and TBI, isolated the network, and retained forensic vendors. Remediation includes migrating to cloud environments, rebuilding networks, and offering IDX identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d36 weeks discovery → filing

Incident timeline

discovery → filing · 36 weeks / 252 days

Oct 17, 2025

Discovered

Jun 26, 2026

Filed

vs. sector median

+25 wks slower

This filing is one of 6 about the same incident.View merged incident

A leak claim by dragonforce about this victim predates this filing by 252 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitedragonforcebd_c1ed5bde1a04520a2025-12-08 · +199dVerified by operator
Leak Sitedragonforcebd_ddd03a25b0420e0b2025-10-17 · +252dVerified by operator

Regulatory filings (3) · sorted by filing gap

Nebraska State AGbd_b2f08d6c56b6ad372026-06-26Verified
Indiana State AGbd_cbeb9c854cbd41022026-06-26Verified
Vermont State AGbd_27c878ffbf3c43a02026-06-23 · +3dVerified by operator

Name: City of La Vergne
norm: city of la vergne
Domain: lavergnetn.gov

Name: City of La Vergne
norm: city of la vergne
Domain: lavergnetn.gov
Industry: Governmentllm

Discovered: Oct 17, 2025
Materiality determined: —
Notification sent: Jun 26, 2026
Affected individuals: 14state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Contacted the T.B.I. and the F.B.I., who have been on-site assisting with the investigation
Initial access: phishing_link

During the incident: Shut down its entire network and isolate the issue
Contacted the T.B.I. and the F.B.I., who have been on-site assisting with the investigation
Retained an outside computer forensics vendor to conduct an investigation
Rebuilding its entire computer network from backups unaffected by the ransomware attack
Offering identity theft protection services through IDX
Changes made: Procured new hardware and software systems
Migrated critical systems to protected cloud environments
Redesigned and segregated networks
Consulting services to implement security policies and procedures to meet or surpass industry standards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 36 weeks(252 days from discovery to filing)
Compliance flags: MA AG >90dLeak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Vermont State AGJun 23 · first

Nebraska State AG+3d

Indiana State AG+3d

Massachusetts State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1039-city-of-la-vergne-tennessee/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 26, 2026
Raw hash: 5bcc772edd40129891f162cc4eb3ce7518c6607e2c0fdc1ddb18719cd8040ce5

Linked disclosures

Ransomware claims (2)

Regulatory filings (3) · sorted by filing gap

Reporting entityCity of La Vergne

Victim entityCity of La Vergne

Incidentdiscovered Oct 17, 2025

Stated responseShut down its entire network and isolate the issue

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov