Vicksburg, Mississippi, City Network Hit by Ransomware; FBI Assists Probe

Key points

• Ransomware forced Vicksburg, Mississippi, to disconnect city systems.
• Mayor Willis Thompson confirmed service interruptions and an ongoing investigation.
• The FBI is assisting local authorities.
• No CVE is tied to this event; containment and recovery are the focus.
• Residents should expect delays for some municipal services.

Vicksburg, Mississippi, is responding to a ransomware event that led officials to take parts of the municipal network offline. Mayor Willis Thompson has acknowledged that residents are seeing interruptions in local government operations while crews work to assess the scope. The choice to disconnect affected systems appears aimed at stopping further spread and preserving evidence.

The disruption affects city departments and the public-facing services they provide. Systems used for routine transactions, internal communication, or records access may be unavailable until restoration is complete. Because this is a city government environment, the consequences extend beyond one office: billing, permits, scheduling, and other daily functions can stall when core infrastructure is isolated.

The FBI is involved in the investigation, which signals that authorities are treating the intrusion as a criminal ransomware case. Attackers in these incidents often seek payment, but the public facts here do not confirm a demand or payment. The immediate priority is containment, forensic review, and determining whether data was accessed or encrypted.

No specific CVE is associated with this event, which is common when initial access comes through credential abuse, phishing, exposed remote access, or unpatched software rather than a single named vulnerability. For K-12 and government peers, the case is a reminder that identity controls, offline backups, segmentation, and tested recovery plans matter more than any one product.

What to watch: updates from Vicksburg officials on restoration timelines, whether the FBI attributes the activity to a known ransomware group, and whether personal information was exposed. Until systems return, residents should use official channels for urgent needs and avoid spreading unverified claims.

What to do now

1. Isolate affected network segments and disable remote access until forensics confirm containment.
2. Preserve logs, disk images, and ransom notes; do not power off or wipe systems before evidence collection.
3. Notify the FBI and CISA, follow their guidance, and coordinate public messaging through one approved channel.
4. Restore from known-good offline backups and validate integrity before reconnecting to production.
5. Reset credentials for privileged and service accounts; enforce MFA and review access permissions.
6. Patch internet-facing systems and close exposed RDP, VPN, and remote management gaps.
7. Run a tabletop exercise and phishing awareness refresher for staff who handle sensitive city data.

Original source

The Record