Stevens Point Contains Suspected Ransomware Attempt on City Servers

Key Takeaways

• Stevens Point quarantined affected systems after detecting unauthorized access and unusual server activity.
• Emergency services remained operational, and officials reported no evidence that data was stolen.
• A restoration window of roughly two weeks highlights the operational cost of cautious recovery, even when encryption is prevented.

A quick quarantine appears to have kept a suspected ransomware attempt against Stevens Point, Wisconsin, from escalating into a broader municipal crisis. City staff detected unauthorized access and anomalies on city servers, isolated affected systems and began a controlled recovery process.

The disruption still affected some city devices and services. Emergency operations, however, remained available. Officials also said there was no evidence of data theft, an important distinction because current ransomware campaigns frequently combine system encryption with data exfiltration and extortion.

According to WSAW, Stevens Point expects restoration to take about two weeks. That timeline does not necessarily signal severe technical damage. In many incidents, recovery moves slowly because administrators need to validate systems, reset credentials, examine logs and confirm that restored devices are not reintroducing compromised accounts or malicious software.

Containing an intrusion and restoring normal operations are separate jobs. Disconnecting servers can happen quickly, but rebuilding trust in an environment takes longer, particularly when a municipality depends on interconnected identity services, file shares, payment systems, departmental applications and third-party support tools.

The Stevens Point response broadly reflects recommendations in joint ransomware guidance from CISA, the FBI and MS-ISAC. Their guidance encourages organizations to isolate potentially compromised hosts immediately, including before encryption is observed, while preserving logs and investigating affected user and administrative accounts. Early isolation can limit lateral movement and reduce the number of systems that require rebuilding.

That matters for local governments, which often operate with smaller security teams than large enterprises while supporting services that cannot tolerate lengthy outages. Between 2018 and 2024, ransomware targeted 525 U.S. federal, state or local government entities and generated an estimated $1.09 billion in downtime. This figure illustrates why a contained incident still carries substantial operational costs through staff overtime, forensic work, delayed transactions and recovery support.

There is also a broader lesson for infrastructure planning. Municipal security programs tend to receive attention during tool purchases, but architecture often determines how far an attacker can travel. Network segmentation can separate public safety, administrative, financial and public-facing environments. Multifactor authentication can make stolen passwords less useful. Least-privilege controls can reduce the reach of a compromised account.

Backups remain part of the equation, but simply having them is not enough. Offline or immutable copies can help protect recovery data from attackers, while regular restoration tests reveal whether those copies are complete and usable. What good is a backup if administrators discover during an outage that it depends on the same compromised identity system?

Internet-facing systems deserve particular scrutiny. Federal guidance prioritizes patching known exploited vulnerabilities in VPN appliances, firewalls and remote-access infrastructure. Recent advisories have connected ransomware activity to vulnerabilities such as CVE-2024-55591 and CVE-2025-24472. Those examples do not establish how Stevens Point was accessed, and city officials have not publicly attributed the attempt to Gunra, Medusa, Akira or another ransomware family. They do show why externally reachable devices remain a practical focus for defenders.

Technology from vendors such as Microsoft, CrowdStrike and Fortinet can support identity protection, endpoint monitoring and perimeter defense, but configuration and operating discipline remain central. Alerts need owners. Privileged accounts need review. Logs need sufficient retention. Incident-response procedures also benefit from being rehearsed rather than opened for the first time during an outage.

For business and technology leaders, the useful signal from Stevens Point is not just that emergency services stayed online. It is that decisive containment can trade a potentially destructive event for a slower, more manageable recovery. Two weeks of restoration work is still disruptive. Yet if forensic review continues to find no stolen data and quarantined systems return safely, the city's early response may have prevented a much more expensive outcome.