US Town Office Closes After Suspected Ransomware Attack Encrypts Network Files

The Lincoln Town Office in Maine closed Monday after officials discovered a cybersecurity incident affecting parts of the town’s computer network.

The town officials revealed that their IT service provider notified them Saturday that someone encrypted files on certain parts of the network. Findings from initial investigation suggest the breach may have started as early as August 13.

At the time of reporting, officials haven’t yet named the attacker or whether they received any ransom note. The incident was still under review as of Monday. Officials were working to learn which systems and information the attack affected.

Several Town Systems Took the Hit

The attack affected several computer systems, including the town’s main file server and other network equipment.

The town took steps to isolate the affected systems after detecting the problem. The goal was to stop the incident from reaching more parts of the network.

The town’s IT staff were also examining available backups. They were working on a plan to bring systems back online without putting clean systems at risk.

That process can take time after files are encrypted. Restoring systems too soon could give attackers or any form of malicious software a chance to come back in.

The Cybersecurity and Infrastructure Security Agency, CISA, also urges organizations to pull affected systems off the network right away during a ransomware attack. And before restoring anything, organizations need to ensure the systems are actually clean.

Lincoln has not said whether or not the attacker stole data. It also has not said whether personal information belonging to residents was exposed.

That distinction matters. File encryption can prevent access to data without proving that an attacker copied the data first.

Town Services Face Temporary Disruptions

The incident forced the Town Office to close while officials assessed the damage. Some of the town’s services will be on hold temporarily. They did not give a specific date when the office would open again.

Instead, they directed residents who needed certain services to state websites instead. People renewing vehicle registrations would have to use Maine’s online rapid renewal service.

Residents seeking hunting or fishing licenses, or renewing ATV and boat registrations, were directed to the Maine Department of Inland Fisheries & Wildlife.

Also, officials told residents needing copies of vital records to use the state’s online service. Usually, the Town Office is open weekdays from 8 a.m. to 5 p.m, and is located at 29 Main St., Lincoln.

Lincoln had Already Invested in Cyber Defenses

The incident comes despite several cybersecurity measures that Lincoln had put in place before the attack.

The town’s 2024 annual report said its network faced multiple intrusion attempts every minute. It also said employees had received security awareness training for years.

The town had upgraded its file servers and kept copies of data across physical locations. They’ve also moved some less critical backups to cloud storage.

The report said the town planned further security upgrades. Those plans included stronger network controls, better authentication and disaster recovery exercises. Lincoln’s 2025 annual report shows that its security program had expanded further.

The town said Microsoft 365, VPN and workstation logins now require multi-factor authentication. Officials said they switched to new networks and implemented tighter controls for access to the servers. Doing these can help reduce risk, but they can’t stop an attack from happening.

Maine is Working to Improve Local Government Security

Lincoln’s incident also highlights the wider cyber risk facing small local governments.

In Maine’s cybersecurity strategy, the state highlights that the security capabilities of the local organizations vary. Moreover, the lack of appropriate personnel and funds is another issue for the local government agencies.

But the state has deployed federal funds to assist these entities- counties, towns, school districts- in enhancing their security posture.

Maine’s State and Local Cybersecurity Grant Program supports projects designed to reduce cyber risks in local government systems. The program also provides security training and other resources.

The state’s emergency management agency warns that malicious cyber activity is a growing threat to Maine’s computer systems and critical infrastructure.

Investigation Continues

For now, the biggest unanswered questions concern the cause and scope of the Lincoln incident.

The officials have yet to identify who might be responsible for the attack, and haven’t confirmed if it’s a ransomware attack or if there’s a ransom demand. Also, they haven’t said if the attackers stole data or not.

For now, their focus is on determining which systems took the hit and what type of data the incident must have compromised.

Lincoln Town officials’ decision to isolate the affected systems is in line with standard CISA guidelines for handling intrusions of that magnitude. CISA advises keeping backups offline and testing them regularly, just to make sure they actually work when you need them.

The Lincoln incident is part of a growing pattern of cyberattacks on local government entities. In a separate case, a threat actor claimed to have breached the French municipal police, offering stolen data for sale on an underground forum and citing a compromised RDP server as the entry point, demonstrating the persistent vulnerabilities in municipal networks.

Some ransomware doesn’t just hit the main files, it often goes after any backups it can find, which makes bouncing back even harder. Town officials stated that the Town Office would open when they are able to restore normal activities.

Until then, residents should expect some services to remain limited while the investigation and recovery work continues.