Fort Smith Confirms Data Removal as Interlock Ransomware Claims Attack

Key Takeaways

• Fort Smith found no evidence that residents’ banking or credit-card information was compromised.
• An unauthorized actor entered through Police Department systems and removed some city data.
• Interlock Ransomware claimed responsibility, but its assertions about stolen records remain unverified.

Fort Smith has drawn an important distinction in its latest cybersecurity update: data was removed from city systems, but investigators have found no evidence that residents’ or customers’ credit-card and banking information was compromised.

The city disclosed the findings on Sept. 23, 2026, following its investigation into the Aug. 16 cybersecurity event. According to Talk Business & Politics, Fort Smith said its financial, accounting, customer-data, and human-resources systems were not involved in the intrusion.

While this limits the scope of the breach, Fort Smith confirmed that an unauthorized actor gained access through Police Department systems and removed an unspecified amount of city data. Officials are still reviewing what information was involved and whether applicable laws require notifications to individuals or other parties.

Finding "no evidence" of financial-data exposure is not the same as concluding that no sensitive information left the environment. The wording reflects the limits of a continuing forensic review. Police systems can contain records with personal, investigative, administrative, or employee information, depending on the systems reached. Fort Smith has not publicly confirmed that any particular category of sensitive record was taken.

Interlock Ransomware has claimed responsibility for the incident. KUAF reported the claim as the city’s investigation approached completion, while the DysruptionHub incident registry has also tracked the event. Still, a ransomware group’s leak-site statements are not independent proof of what it accessed or exfiltrated. Interlock’s allegations involving sensitive records have not been verified by Fort Smith.

Public pressure is a core component of the extortion model. Claims of large or damaging thefts can increase anxiety among officials, residents, employees, and business partners, making disciplined verification essential. Organizations responding to such incidents compare attacker-provided samples, access logs, endpoint telemetry, identity records, and network activity before confirming the scope of a breach with confidence.

Fort Smith said the threat has been contained, public-facing services have been restored, and no ransom was paid. The incident nevertheless caused visible operational disruption. Card-payment processing was affected at City Hall, the landfill, and District Court after the Aug. 16 event. That interruption showed how a cyberattack can affect payment availability without demonstrating that stored payment credentials were exposed.

A disabled payment workflow might result from systems being isolated as a precaution, network dependencies becoming unavailable, or recovery procedures taking services offline. None of those conditions, by themselves, establishes that card numbers or banking details were stolen.

For Fort Smith, the next phase centers on data classification and notification analysis. Investigators will need to determine which files were accessed, whether the removed data can be tied to identifiable people, and which legal or contractual reporting requirements apply. The answer may differ by record type. Police information, employee files, payment data, and general administrative documents can each trigger different review paths.

The episode reinforces the value of segmenting police, financial, human-resources, and customer systems. Segmentation can limit an intruder’s movement, while endpoint detection, identity monitoring, centralized logging, and tested recovery procedures can shorten the time needed to understand an incident. Products from CrowdStrike, Palo Alto Networks Unit 42, and Microsoft Defender represent different components of that broader detection and investigation market.

Fort Smith’s update narrows the known impact without eliminating uncertainty. Financial systems appear to have remained outside the intrusion, services are operating again, and the city did not pay a ransom. Yet data was removed, Interlock Ransomware is making claims, and the notification review continues. For residents and business partners, the most consequential disclosure may come when Fort Smith finishes identifying exactly what left its Police Department systems.