Delaware County, Pennsylvania investigates network intrusion after outage

Editor’s note: This story was first published June 29, when Delaware County had publicly described the disruption as a network outage and had not said whether cybersecurity was involved. It was updated July 1 with a county statement to DysruptionHub about service restoration, and updated again July 2 after the county said unauthorized activity disrupted its network and that it shut down network access in response to intrusion attempts.

Delaware County, Pennsylvania, said unauthorized activity disrupted its network beginning June 26, prompting the county to shut down access while it worked to protect sensitive information and critical systems.

The county had previously described the disruption publicly as a network outage and provider disruption. It later said the incident involved “intrusion attempts.”

Delaware County said it is restoring network access disrupted “due to unauthorized activity” affecting the county’s network. The county said it took the “proactive but necessary step” of shutting down the network while following industry practices in response to the intrusion attempts.

Delaware County Council posted a July 2 statement saying unauthorized activity disrupted the county’s network and that officials shut down network access in response to intrusion attempts. (Screenshot by DysruptionHub)

Delaware County Council said June 26 that the outage affected some services and offices at the Government Center Complex in Media, with some offices experiencing a loss of phone connectivity. At the time, the county said other county offices around Delaware County had not reported network issues.

“At this time, internet and phone service has been restored,” the county said.

In an email to DysruptionHub on July 1, Delaware County said it was continuing to respond to an “extended network disruption” and working to re-establish network access. The county said most phone services and internet access had been re-established and that critical services were being maintained.

Delaware County did not respond to a DysruptionHub follow-up question asking whether the disruption was being investigated as a cybersecurity incident or whether cybersecurity involvement had been ruled out. In a later statement, the county said it was responding with help from cybersecurity specialists to confirm network security.

Delaware County Council posted a June 26 notice saying a network outage at the Government Center Complex in Media, Pennsylvania, disrupted some county services and phone connectivity. (DysruptionHub screenshot)

The Delaware County Sheriff’s Office said Monday that the outage was affecting county servers, phone lines and facilities, including the sheriff’s office. The office said all systems were offline and that no inbound or outbound calls were going through to county offices or the sheriff’s office.

The sheriff’s office said county IT and communications teams were working to resolve what it called a “provider disruption.”

Delaware County Libraries also posted a network outage notice saying public access computers and in-library catalogs were not available and asking patrons to bring library cards to check out items. DysruptionHub emailed the library system seeking confirmation on whether that disruption is connected to the county network outage.

Chip in once If this reporting helped you, a one-time tip helps cover hosting, tools and future investigations.

Tip us

Support us monthly A small monthly pledge keeps independent coverage and our reader tools online for everyone.

Become a Supporter

Delaware County, outside Philadelphia, includes 49 municipalities across more than 184 square miles, according to the county website.

The outage follows a previous ransomware incident involving Delaware County government. WHYY reported in January 2021 that a county memo said the government network was accessed through a phishing email in September 2020, ransomware was activated and the county paid a $25,000 ransom.

Delaware County has confirmed unauthorized activity and intrusion attempts after initially describing the disruption as a network outage. The county has not publicly said whether the incident involved ransomware, data theft or a ransom demand.

Attribution note: DysruptionHub credits upstream reporting and primary sources—see citations above. If this report informed your coverage, please cite DysruptionHub with a link.