# Ransomware Attack Disrupts IT Systems and Services in Ellis County, Kansas

> Ellis County, Kansas discovered a ransomware attack on parts of its information technology systems in the early morning of Thursday, September 17, 2026. County officials isolated the affected systems, engaged outside cybersecurity specialists, and warned that some county services may be unavailable, delayed, or operating differently for days or weeks.

- **Published:** 2026-09-18T12:00:00Z
- **Last reviewed:** 2026-09-18T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2571
- **ID:** TL-2026-2571
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 4 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On the morning of Thursday, September 17, 2026, Ellis County, Kansas (seat: Hays) discovered a ransomware attack affecting portions of its county government information technology systems. Officials stated they immediately took steps to contain the disruption by isolating the affected systems and engaging outside cybersecurity specialists to investigate and assist recovery. Local law enforcement, the Kansas Highway Patrol, and the Kansas Bureau of Investigation (KBI) were brought in to support the response. The county publicly disclosed the incident on Friday, September 18, 2026, warning residents that some county services may be unavailable, delayed, or operating under temporary procedures for days or weeks, while confirming that 911 and emergency public-safety response were not affected. Officials stated that, as of disclosure, there was no evidence that personal or sensitive information had been accessed or obtained, though the investigation was ongoing; residents were advised to exercise caution with any emails purporting to come from the county's official ellisco.net domain and to contact individual departments directly for service-availability updates.

As of this writing, no ransomware group has publicly claimed responsibility (no leak-site posting identified), no CVE or specific initial-access vector has been disclosed, and no technical indicators of compromise (malware family, hashes, C2 infrastructure) have been made public. The incident is consistent with a broader, well-documented wave of ransomware intrusions against U.S. state, local, tribal, and territorial (SLTT) government entities through 2025-2026, which CISA and the Multi-State Information Sharing and Analysis Center (MS-ISAC) attribute predominantly to phishing, exposed/unpatched remote-access services (RDP/VPN), and stolen or brokered credentials as initial-access vectors, followed by living-off-the-land lateral movement, credential dumping, and data encryption for impact. The MITRE ATT&CK techniques mapped below reflect this documented SLTT ransomware pattern per CISA/MS-ISAC #StopRansomware guidance and are NOT forensic findings confirmed specific to the Ellis County intrusion; they are included to give defenders a sourced, evidence-grounded starting hunt/detection baseline pending further disclosure. Exfiltration- and collection-tactic techniques are deliberately excluded because officials explicitly stated no evidence of data access has been found.

## MITRE ATT&CK

- T1566 Phishing
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1078 Valid Accounts
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1490 Inhibit System Recovery

## Sources

- [Ransomware attack on Kansas county will affect some services](https://databreaches.net/2026/09/18/ransomware-attack-on-kansas-county-will-affect-some-services/)
- [Ransomware attack on Kansas county will affect some services](https://malware.news/t/ransomware-attack-on-kansas-county-will-affect-some-services/125723)
- [Ransomware attack on Kansas county will affect some services](https://www.ksn.com/news/state-regional/ransomware-attack-on-kansas-county-will-affect-some-services/)
- [Ellis County reports ransomware incident](https://hayspost.com/posts/e81e8354-23bb-4821-8b53-e22aa23d0c6a)
- [Ellis County reports ransomware incident – Hays Post (syndication)](https://hacknotice.com/2026/09/18/ellis-county-reports-ransomware-incident-hays-post/)
- [Ellis County, KS Official Website – Ransomware incident page](https://www.ellisco.net/564/Ransomware)
- [#StopRansomware Guide (CISA / MS-ISAC)](https://www.cisa.gov/stopransomware/ransomware-guide)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2571