Petersburg Borough in Southeast Alaska has confirmed that ransomware locked computers on its network on July 11, 2026. The attackers demanded about $1 million in Bitcoin to restore access. Borough Manager Stephen Giesbrecht told the Petersburg Pilot this week that the borough refused to pay. "We're not going to pay ransomware," he said. The borough did not tell the public until a community notice on October 16, more than three months after the attack. That notice says the attack reached the borough's utility billing software, where customer names and utility account numbers could be accessed. The borough has not said whether the attackers viewed or copied those records, and no group has claimed the attack.
What Happened
Borough staff first noticed something was wrong when they could not get into some of their computers. The borough's IT contractor, Professional Computer Solutions (PCS), responded. Borough Clerk Becky Regula told KFSK that PCS "had shut down everything within minutes of realizing there had been a breach."
According to Regula, PCS said there had been a ransom demand, but she did not see it herself. Most of the employees she spoke to "just were locked out of their computer." Giesbrecht later gave the Petersburg Pilot the first public figure for the demand: about $1 million in Bitcoin, sent by "an outside bad guy" who said the borough would have to pay to get its computers working again.
During recovery, the borough stopped using its own systems to talk about the attack. Accounts differ on who gave that advice. KFSK attributes it to PCS. The Petersburg Pilot quotes Giesbrecht saying "outside experts" told the borough to stay quiet. The borough's notice, as reported by Dysruption Hub and BeyondMachines, says only that officials were advised to limit what they disclosed. Everyone agrees on the reason: the attackers might still be watching borough systems. Staff were told about the attack through hand-delivered paper memos and one-on-one conversations instead of email. While the PCS team travelled to Petersburg, local business Homeport Electronics wiped affected machines and reloaded their software.
The borough reported the attack to the FBI and the Alaska Department of Public Safety. KFSK says the Attorney General was also told. The first public sign of the attack was an assembly agenda posted on October 15. It scheduled a closed executive session for October 20 to discuss "network vulnerabilities and security responses related to a recent ransomware attack." The full community notice followed the next day.
There is one unexplained detail. A separate borough notice on October 6 blamed late September utility bills on a "server issue." The borough has not connected that delay to the July attack.
What Was Taken
The borough has not confirmed that any data was stolen, and its own officials have described the exposure differently:
- The borough's notice says customer full names and utility account numbers could be accessed through the affected billing software. It does not say whether the attackers viewed or copied them.
- Borough Clerk Becky Regula told KFSK that "no personally identifiable information, or PII, was exposed."
- Payment data: the borough says customer credit card and banking details were not stored on the compromised network and were not accessed.
The borough has not said how many customers had names and account numbers in the affected system. The difference between "accessible" and "not exposed" matters legally. One summary of Alaska's breach notification law (AS 45.48) says an account number on its own can count as covered personal information, and that notice must be given "without unreasonable delay," with extra time allowed for law enforcement needs and for working out the scope of the breach. The borough has not said whether it considers the incident a notifiable breach under that law, and it has not published individual notification letters.
Why It Matters
Small local governments are an easy target for ransomware. They usually have no in-house security team and depend on one outside IT provider. Petersburg is a borough of a few thousand people about 120 miles south of Juneau, and its response depended on a contractor who had to travel there. That it recovered at all owes a lot to a local electronics shop doing the first rebuild work.
The refusal to pay is the main point for defenders. A borough this size could only refuse a $1 million demand because it was able to rebuild its machines itself. A fast shutdown, clean reinstalls and adding multifactor authentication afterwards made that possible. Organisations without recoverable backups and a rehearsed plan to rebuild do not really have that choice.
The three-month gap before public disclosure is also worth noting. Delaying disclosure while attackers may still be inside the network is a recognised containment step. But utility customers whose names and account numbers may have been exposed spent three months without the information they needed to watch for scams that use their account details.
Elsewhere in Alaska, a September cyber incident disrupted phone service at the North Slope Borough School District. This is part of a wider run of attacks on local public bodies in the state, though nothing publicly links the two incidents.
The Attack Technique
The borough has not said how the attackers got in, which ransomware strain was used, or whether data was copied out before encryption. Its notice says only that "although the Borough has security measures in place, they did not fully prevent the attack." KFSK reports that PCS was "adding multi-factor authentication" during recovery, which suggests MFA was not fully in place across borough systems before the attack. No ransomware group has publicly claimed Petersburg.
Nothing connects this attack to any particular threat actor. For general context, a CISA advisory published on October 8 (AA26-281A) describes the techniques most often used against state and local government networks: password spraying against Microsoft Exchange, exploiting old VPN and web application flaws (including CVE-2019-11510 in Pulse Secure VPNs), and getting through exposed remote-access services. That advisory concerns a separate espionage campaign linked to China and has no known connection to Petersburg. Its list of entry points is still a useful checklist for small governments.
What Organizations Should Do
- Require multifactor authentication on every remote and email login before an incident. Petersburg's contractor was rolling out MFA during recovery. Prioritise VPNs, webmail, remote desktop and the admin accounts your IT provider uses.
- Keep offline, tested backups of billing and finance systems. Being able to wipe and reload machines is what let the borough refuse a $1 million demand. Test restores on a schedule, not for the first time during an incident.
- Write down a way to communicate without your own network. Agree in advance on phone trees, paper memos or separate accounts for times when email may be watched by attackers, as Petersburg had to work out on the spot.
- Reduce what is stored in exposed systems. The borough's decision to keep card and bank data off its network limited the damage. Check what customer data lives in billing software and remove anything that does not need to be there.
- Close unused services and patch internet-facing devices. Disable remote access and file-sharing protocols that are not needed, and patch VPN and mail servers quickly, as CISA recommends.
- Set notification triggers in advance. Decide with legal counsel what makes an incident notifiable under state law, for example whether an exposed account number counts, so that a delay requested by law enforcement does not turn into months of silence for affected residents.
Sources: Ransomware attackers demanded $1 million from borough; officials re... | Chinese Government-linked Cyber Threat Actors Combine Automated and... | Ransomware attack on Petersburg Borough computer network resolved -... | Petersburg, Alaska, ransomware affected utility billing | Newly elected Petersburg Borough Assembly members to swear in Tuesd... | Alaska Data Breach Notification Law: Covers Paper Records | Ransomware colpisce la fatturazione delle utenze a Petersburg | Petersburg Borough Discloses Ransomware Attack on Utility Billing S...