Mayor says Michigan City responding to ransomware attack; investigators and restoration teams working

Mayor Angie Nelson told the Michigan City Common Council on Oct. 7 that the city’s computer network had experienced a ransomware incident that encrypted portions of the system and temporarily disrupted access to files and email.

Nelson said the city held an executive session with the council and that a third‑party forensic incident response team is leading the investigation. She said the city’s information‑technology staff, led by Andy Metanik, are isolating affected systems and restoring operations department by department. She also said law enforcement was notified the morning the incident was discovered.

The mayor told council members the city received a Bitcoin ransom demand but has chosen not to negotiate with the threat actor. “We’re not gonna negotiate with the threat actor,” she said, and added that IT and outside specialists are restoring critical functions and that teams are working seven days a week to secure systems.

Officials said limits on public disclosure stem from the ongoing forensic investigation. The mayor urged departments to include IT when procuring new software, saying disparate systems across departments increased recovery complexity.

Why it matters: A municipal ransomware event can affect public services, records access, and resident-facing functions. Officials said restoration is underway but did not provide a full list of systems affected at the Oct. 7 meeting.

What’s next: Administration said it will provide updates as the investigation and restoration continue.