Cybersecurity Incident Information

Update: June 2025 

As previously mentioned, the Town continues to work with a third-party expert team to analyze the data involved to determine whose and what data was impacted. Though this process takes time, we continue to make progress every day on this effort. Again, if we learn that your information was impacted, we will notify you in compliance with applicable state laws. 

We also wanted to provide assurances that the cybersecurity incident is no longer ongoing. We engaged the North Carolina Joint Cybersecurity Task Force (a team of outside experts from the NC National Guard, the NCLGISA Cybersecurity Strike Team, NC Emergency Management, and NC Department of IT, collectively the “Cybersecurity Task Force”) to lead the forensic investigation. In consultation with the Cybersecurity Task Force, the unauthorized activity was eradicated from the Town’s environment within days of the incident, with no indications of any continued persistence of any unauthorized activity.  

We are confident in the security and integrity of our systems, having implemented an exhaustive rebuilding process designed to reduce the risk of future similar incidents.  As we have been advised by experts, we followed the best practices in this situation, which was to rebuild on clean systems. To that end, every device, network component, and domain was completely reconstructed, confirming no fragments of previous infrastructure remained. By July 8, 2024, every system (whether identified as affected or not) was wiped clean, and the entire network was rebuilt from the ground up. Again, we restored the Town’s systems as securely as possible in close coordination with the Cybersecurity Task Force.  

To further reinforce the Town’s security, we have significantly increased security assessments and monitoring over our environment. Additionally, we have strong assurances from our legal counsel and trusted vendors, verifying that every system was entirely rebuilt and no legacy components were reused. The comprehensive and proactive measures we have taken demonstrate our commitment to maintaining a secure and resilient environment. Currently, in the months since we completed our recovery and implemented additional monitoring, there has been no evidence of any unauthorized activity in our systems.   

Updated April 2025

The Town has continued to actively pursue its investigation into the cybersecurity incident of July 2, 2024, and especially prioritizing learning what and whose data was impacted. To that end, we took the additional step of arguing for and obtaining a court order in order to recover materials that could further our investigation into what data was impacted. In addition to reviewing and verifying the materials obtained by the court order, the Town is engaging an expert team to analyze the relevant data to determine whose and what data was impacted. If we learn that your information was impacted, we will notify you accordingly. 

Again, given the nature of the incident and state of the materials for analysis, we anticipate this process will take time. We continue to work with data security and privacy experts to assist with our response and ongoing investigation, and they have advised this is a complex and time-intensive process.

The Town departments have otherwise fully resumed normal business operations, including utility billing, which the Town took additional steps to restore in a a manner that considered our community’s needs and concerns. All information regarding billing can be found on this page, which has been, and continues to be, updated frequently.

Summary of July 2nd Incident

On the morning of July 2nd, the Town of Apex Information Systems Technology (IT) Department discovered irregularities in our systems. We immediately launched an investigation, engaged the services of the North Carolina Joint Cybersecurity Task Force (a team of outside experts from the NC National Guard, the NCLGISA Cybersecurity Strike Team, NC Emergency Management, and NC Department of IT), and reported this event to federal law enforcement. 

We have since confirmed this incident to be a ransomware act. Nothing more about the cybercriminals is known at this time, including their demand – and in compliance with North Carolina law, the Town of Apex has not and will not communicate with, negotiate with, nor make payment to those responsible for this incident.   

We continue to work diligently as the incident response process has required extensive time, labor, and resources to simultaneously recover systems, while investigating and assessing the scope of the incident. We are proud of our team’s significant efforts and utilization of available resources, including the aid of cybersecurity professionals and local and state agencies, and the progress made to date. At no time did any life safety services cease to operate and emergency services have been operational throughout the incident. 

Since the investigation is ongoing, we are not yet aware of what or whose information may have been impacted. However, to the extent that any personal information is involved, we will notify impacted individuals accordingly. 

Due to the nature of the incident, we know this process will take time. We appreciate the community’s patience and cooperation with our alternatives to standard operations. While a summary is provided here, below are prior updates the Town provided throughout our response.

Initial Response Timeline - July 2024

Please note: The timeline below contains the updates posted during the first few days after the incident occurred. Further updates were posted to other sections of this website, including utility billing and building inspections. 

July 3rd, 4:30 pm
On the morning of July 2nd, the Town of Apex Information Systems Technology (IT) Department discovered irregularities in our systems that point to some form of a cybersecurity incident and took immediate actions to secure our environment and contain the situation.

At the same time, the town launched an investigation and engaged the services of the North Carolina Joint Cybersecurity Task Force (a team of outside experts from the NC National Guard, the NCLGISA Cybersecurity Strike Team, NC Emergency Management, and NC Department of IT). We have also reported this event to federal law enforcement agencies.

Our dedicated IT professionals are working diligently with some of the country’s leading experts in cybersecurity to restore Town of Apex systems securely and quickly, and they are making incredible progress.  

It is important to share that our Town has emergency preparedness plans specifically for situations like these and at no time did any life safety services cease to operate. We followed our contingency plan and all emergency services have been operational throughout the incident.

We continue to operate the Town of Apex Government under normal hours, but with limited capacity, as we continue to investigate this matter and work to bring systems back online in a secure fashion and as quickly as possible. Again, all emergency services are fully operational.

While more information will be confirmed in the coming days, our priority is the safety and security of the Apex community. We are committed to addressing the situation quickly and responsibly, by collaborating with legal counsel, technical experts, and cybersecurity professionals. We appreciate your patience as we work to resolve this issue.

July 4th, 1:40 pm
The Town of Apex’s investigation into the cybersecurity incident detected on July 2, has been confirmed as an attempted ransomware act. Nothing more about the cybercriminals is known at this time, including their demand – and in compliance with North Carolina law, the Town of Apex has not and will not communicate with, negotiate with, nor make payment to those responsible for this incident.  

The Town continues to coordinate with law enforcement and engage in extensive incident response and analysis. The nature of the response which includes taking systems offline proactively, requires time, as top cybersecurity professionals work alongside Town staff and local and state agencies to assess what happened, in parallel with recovery efforts.    

The Town appreciates our community’s patience as we work around the clock to securely bring specific operations back online and create alternatives to standard operations, as necessary, to continue to deliver Town services.  

It is important to note that emergency services have not been interrupted, and remain operational.  

July 5th, 3:00 pm
The Town continues to assess the scope of the cybersecurity incident, while simultaneously working to restore systems in a secure manner. Our investigation continues as we coordinate efforts with the North Carolina Joint Cybersecurity Task Force, cybersecurity professionals, local and state agencies, and law enforcement. Emergency services have not been interrupted, and remain operational. We appreciate our community’s patience during this time. 

While most town operations are functioning normally, there is new information about certain operations listed here.

July 6th, 3:00 pm
The Town continues to work around the clock to restore systems and continue its investigative efforts. We appreciate our community’s patience and cooperation with our alternatives to standard operations.  

Information about any changes to services is listed here.

July 11th, 7:30 am
While recovery efforts are ongoing, the Town is proud of the significant progress made to date to restore systems in a secure manner. We appreciate our community’s patience, as the incident response process continues to require extensive effort, time, and labor to simultaneously recover systems, while investigating and assessing the scope of the incident. The Town continues to utilize all available resources, including the aid of the North Carolina Joint Cybersecurity Task Force, cybersecurity professionals, local and state agencies, and law enforcement. 

Meanwhile, we have been providing updates to our operations. Stay tuned today for information regarding utility billing.

July 11th, 12:00 pm
Significant progress has been made in the area of utility billing. Please read this information thoroughly.