Ransomware Hits Vicksburg: Mayor Shuts Down IT Systems, FBI and DHS Investigating

Vicksburg, Mississippi Mayor Willis Thompson confirmed on October 2, 2026 that the city of roughly 20,000 residents suffered a ransomware attack the previous day. IT systems were temporarily shut down as a containment measure. Emergency services — 911, police, and fire — remained operational. The city is now working with the FBI, DHS, and private experts to determine whether personal data was compromised. Thompson ruled out disclosing any technical details to avoid interfering with the investigation.

Verified Facts

On October 1, 2026, the city of Vicksburg suffered a ransomware attack. Mayor Willis Thompson confirmed the incident the following day in an official statement reported by The Record and WLBT.

IT systems were temporarily shut down. The city did not specify which systems were affected beyond in-person public utility payments, which are experiencing delays.

Emergency services — 911, police, and fire — were not compromised. The official statement does not explain the reason for this operational separation.

The city stated it will not impose penalties or interrupt services during the investigation period.

Thompson explicitly stated the city "will not release any technical information that could interfere with the investigation, recovery efforts, or system security." This is a strategic decision, not an indication that investigators lack information.

The Investigation and Its Known Limits

The city is collaborating with the FBI, the Department of Homeland Security, state officials, and private cybersecurity experts. Mayor Thompson stated: "One of the top priorities of our investigation is determining whether there was any compromise of personal or confidential information relating to current and/or former customers, contractors, vendors, employees, or affiliated business partners of the City."

At the time of the statement, "the investigation is ongoing and the City has not reached a final determination regarding what information, if any, may have been accessed or acquired without authorization."

The official release cites Mississippi Code Annotated § 75-24-29, which governs data breach notification obligations. The citation signals that any notifications to affected parties will follow investigative determinations.

No ransomware group has been named. No indicators of compromise have been made public. No independent forensic analysis, security vendor report, CVE, or IoC is available.

"One of the top priorities of our investigation is determining whether there was any compromise of personal or confidential information relating to current and/or former customers, contractors, vendors, employees, or affiliated business partners of the City"
— Mayor Willis Thompson, official statement

Analysis: What Can Be Inferred and What Cannot

FACT: The temporary shutdown of IT systems was the city's chosen operational response. NOT VERIFIABLE: The source does not specify whether this shutdown reflects a structural network condition or a precautionary choice.

FACT: Emergency services remained operational. NOT VERIFIABLE: The release does not document the network architecture, segmentation, or existence of pre-existing analog systems.

FACT: The investigation involves federal agencies and private experts. NOT VERIFIABLE: The brief does not document whether this investigative structure is standard for entities of this size or specific to Vicksburg.

FACT: No technical details have been released. NOT VERIFIABLE: The source does not specify whether this strategy was mandated by federal agencies or is an autonomous decision by the administration.

What to Do Now

For Vicksburg residents, the actions documented in the official release are as follows:

• Await any data breach notifications under Mississippi Code Annotated § 75-24-29, should the investigation determine that personal data was compromised.
• Use alternative channels for utility payments, as in-person payments are delayed.
• Retain payment receipts, as processing systems may not immediately record transactions.

Mayor Thompson indicated that notifications, if necessary, will follow investigative determinations.

Editorial Close

The Vicksburg attack illustrates a recurring pattern in ransomware against local government entities: public confirmation, system shutdown, multi-layered investigation, silence on technical details. What distinguishes this case is the clarity with which the Thompson administration communicated the boundaries of the knowable — roughly 20,000 residents know an incident occurred, that emergency services function, that payments are delayed, and that the investigation is ongoing. What they do not know — and will not know until a new determination — is who attacked, how, and whether their data was exfiltrated. This information structure is not a void to be filled with inferences, but the datum itself to be recorded.

This article is based on Mayor Thompson's official statement and journalistic reproductions of the same; no security vendor or independent forensic analysis is available. Sources: The Record, WLBT, Vicksburg News.

Information is based on the cited source and current as of publication.

Sources

• https://therecord.media/vicksburg-mississippi-government-ransomware-attack
• https://www.wlbt.com/2026/10/02/city-vicksburg-hit-by-ransomware-cyberattack-mayor-says/
• https://blog.rankiteo.com/cit1790908006-city-of-vicksburg-ransomware-october-2026/
• https://vicksburgnews.com/city-issues-release-on-cyberattack/
• https://therecord.media/medusa-ransomware-mississippi-cyber
• https://therecord.media/mississippii-electric-utility-residents-breach
• https://therecord.media/coastal-mississippi-county-recovering-from-ransomware-attack-digital-hurricane