The town council of Bernalillo, New Mexico, has voted unanimously to offer $82,000 to the criminals behind a ransomware attack that has disrupted town services since early to mid October. KOAT first reported the vote, and Hoodline and other outlets have repeated it. The attack closed the town's Motor Vehicle Division office, disrupted police body cameras, and took down online water bill payments. Mayor Jack Torres told KOAT that the council decided to make an offer after consulting outside experts. He said no payment has been made yet. If the attackers accept, KOAT and Hoodline report that the money will come from the town's general fund reserves. No ransomware group has been publicly named. The town has not said how much the attackers first demanded. No regulator filing or breach notification has been published.
What Happened
Bernalillo is the seat of Sandoval County, north of Albuquerque, with about 9,200 residents according to the Census Bureau's 2025 estimate cited by DysruptionHub. Staff at first took the problem for an ordinary outage. "When our town IT director first discovered there was a problem, we thought it was a straight internet outage," Torres said in a town statement quoted by the Albuquerque Journal and the Rio Rancho Observer. "Upon closer inspection, we realized it was a full-blown cyberattack."
Later comments from Torres to KOAT add more detail. The IT director noticed suspicious activity, began shutting devices down, and "eventually, he came across a note from the threat actors, and that's when we realized that it was a full-blown ransomware attack."
Reports disagree on when the attack started: - The Albuquerque Journal quotes acting town spokesperson Augusta Meyers as saying the town reported the incident at about 5:15 a.m. on October 9. - The Rio Rancho Observer dates the outage to October 10. It quotes a town release saying the attack was discovered "sometime over the long holiday weekend." - DysruptionHub notes that an earlier town notice described a network and internet outage with email unavailable. KOB 4 reported that disruption on Friday, October 9, before the town publicly confirmed a cyberattack on Thursday, October 15. DysruptionHub says "the precise start of the attack remains unclear." - KOAT says services have been disrupted "since October 16." That is a day after the town's own public statement about the attack, so it most likely reflects a different milestone, not the start of the intrusion. Hoodline also points out the gap between these dates.
The most consistent reading is that the intrusion was detected on or around October 9 to 10 and publicly confirmed as a cyberattack on October 15. The town has not published a definitive timeline.
Response: Torres said the town contacted law enforcement, including the FBI, and is working with the New Mexico Office of Cybersecurity and outside cybersecurity specialists under an incident response plan. The Albuquerque Journal reported on October 15 that, according to Meyers, the FBI had not yet responded. Police and fire emergency services kept running, according to DysruptionHub, and no interruption to water delivery has been reported. The town waived late fees and suspended service disconnections during recovery.
Current status: KOAT and Hoodline report that most services have been restored, but residents still have to pay water bills in person or by mail. Even if the attackers accept the offer, the town has given no timeline for full recovery and expects substantial recovery work either way.
What Was Taken
It is not yet known whether any data was taken. On October 15, Meyers told the Albuquerque Journal that "no data has been compromised to this point." That statement came before the town publicly called the incident ransomware. Many ransomware groups now steal data before encrypting systems so they can threaten to leak it, so an early "no data compromised" assessment can change once forensic work is finished.
As of the latest reporting: - The town has not said whether residents' personal or payment information was accessed or copied. - No ransomware group has publicly claimed the attack, and no leak site listing has been reported. - No breach notification has been filed. DisclosureLens lists the incident as press coverage only, with the number of affected people "not disclosed."
The systems affected handle sensitive material: motor vehicle records, police body camera footage, and utility billing accounts. Any confirmed exfiltration would matter well beyond the service outage. Residents should treat the question of data exposure as open until the town says otherwise.
Why It Matters
A small town is openly negotiating. Few public bodies admit to ransom negotiations, and fewer vote on them in public. Bernalillo's unanimous vote, with the amount and the funding source named, shows how much pressure a long outage puts on small governments. Efren Lopez, an assistant professor of computer science at New Mexico State University, told KOAT that "a lot of the times, the monetary cost of the operations being down is way more than the actual ransom payment."
Paying guarantees nothing. Lopez also warned that "there is no guarantee that they will actually release the key to decrypt the files," and that paying means "you are funding the attackers." Decryptors that criminals supply are often slow or partly broken. Paying also does not stop stolen data from being leaked or sold later.
An offer is not an agreement. Reports describe this as an offer, which means the attackers have not yet accepted. That suggests a negotiation is under way, probably below whatever the attackers first asked for. The town has not said what that figure was.
Small municipalities keep being hit. DysruptionHub notes a similar suspected incident the same week in Big Spring, Texas, which also knocked out electronic water bill payments and led the city to waive late fees. Towns of this size often run a lean IT department, keep billing, records, and police systems on shared networks, and have few backups that are separated from the main network. Those are the conditions ransomware groups take advantage of.
Legal exposure. Any US entity that pays a ransom risks violating sanctions if the recipient is on the Treasury Department's sanctions list. The Office of Foreign Assets Control (OFAC) has warned about this repeatedly. Unless the attackers are identified, the town cannot fully assess that risk.
The Attack Technique
The town has not said how the attackers got in, and no group has been named, so there are no indicators of compromise to share. What is known:
- Detection: The IT director spotted suspicious activity that at first looked like an internet outage. Email and network access failed early, which fits with encryption or attackers disabling core infrastructure such as domain controllers, firewalls, or mail servers.
- Containment: Staff shut devices down manually. The attackers' ransom note was found during that process.
- Timing: Discovery over a long holiday weekend, or just before one, fits a common ransomware pattern. Attackers deliberately launch encryption when staffing is thin to slow down the response.
- Scope: Systems affected included MVD terminals, online payment portals, email, and police body camera infrastructure. That points to a flat or poorly separated network where one foothold could reach several departments.
The usual ways into small government networks are exposed remote access services (RDP, VPNs without multi-factor authentication), unpatched devices on the network edge, and stolen credentials. None of these has been confirmed for Bernalillo.
What Organizations Should Do
- Decide on ransom policy before an attack. Councils and boards should agree in advance who has authority to pay, what legal and sanctions checks are needed, and how insurance applies. Making those decisions in the middle of an outage favours the attacker.
- Keep backups that the main network cannot reach. Store copies of billing, records, and police evidence systems offline or in immutable storage, and test restoring them at least every quarter. Being able to restore is the strongest bargaining position available.
- Separate critical services. Put police systems such as body camera storage, payment systems, and state-connected services such as MVD terminals on separate network segments with tight access rules, so one intrusion cannot take down all of them.
- Close the common entry points. Require multi-factor authentication on all remote access, VPN, and email accounts. Remove RDP exposed to the internet. Patch firewalls and VPN devices as soon as fixes for known exploited flaws are released.
- Watch the network around holidays. Make sure someone is monitoring, or a managed detection provider is covering, long weekends and holidays. Alert on mass file changes, backup deletion, and new administrator accounts.
- Bring in state and federal help early. Small municipalities should set up contacts in advance with their state cybersecurity office, CISA, and the FBI field office. They should also use free services such as CISA's vulnerability scanning and the MS-ISAC resources for state and local governments.
Sources: Bernalillo offers $82,000 to hackers to resolve ransomware attack... | Town of Bernalillo victim of cyberattack | Bernalillo offers $82,000 to hackers to resolve ransomware attack | Town of Bernalillo working to resolve cyberattack outage | Bernalillo cyberattack blocks payments in New Mexico | Bernalillo, NM Offers Hackers $82,000 After Cyberattack | Bernalillo Town Responds Quickly to Weekend Cyberattack, Services R... | Bernalillo data breach report (2026) — press coverage, not a regula...