DuPage County says ransomware hit sheriff, 18th Judicial Circuit and circuit clerk; investigation ongoing

Chairwoman (meeting chair) told the DuPage County Technology Committee on May 6, 2025, that DuPage County was the target of a ransomware attack last week that affected the sheriff’s office, the 18th Judicial Circuit and the circuit court clerk’s office.

The county’s Information Technology staff is conducting a coordinated investigation and recovery effort with the affected offices and outside cybersecurity experts, and officials said they cannot release sensitive details while the investigation is active. "Please remember that the team cannot answer questions or share sensitive details about the incident as this investigation and recovery efforts are ongoing," the chairwoman said.

Why it matters: the incident disrupted systems used by law‑enforcement and court operations and prompted county officials to review communications and continuity procedures for elected offices and departments.

IT staff told the committee they worked through the weekend with the circuit clerk, the 18th Judicial Circuit and the sheriff’s office and that affected offices were notified early in the response. Recorder Dave Chapman said his office did not receive an official notification until late Tuesday and asked for clearer, earlier communications in future incidents so line staff answering public calls would not be left uncertain. "It would just be nice to have some kind of information so we're prepared when they take those calls," Chapman said.

IT staff acknowledged gaps in outbound communications and said the county will hold a post‑mortem "lessons learned" session when the investigation allows fuller disclosure. The county also said it prioritized restoring access for groups with urgent operational need but is delaying reconnection of some systems until investigators clear them.

Auditor White asked whether temporary workstations could be set up in county buildings for offices that lost access to critical systems such as accounts payable and budgeting. IT responded that they are prioritizing access for the most critical groups and that the current recommendation is not to reconnect systems until the investigation is complete; the county is evaluating temporary accounts and alternate email addresses as a mitigation step.

One participant at the meeting said investigators suspected a foreign actor may have been involved; county staff repeatedly declined to speculate publicly and said they will not comment further until investigators complete their work. Officials said affected parties were notified at 3 a.m. when the response began and that the county will prepare a consolidated report and recommendations for the board once the analysis is finished.

Ending: County staff said they will present findings and security recommendations after the investigation, and members suggested an elected‑official roundtable or executive session to discuss coordination and shared network policies after the post‑mortem is complete.