Ransomware gang Beast today took credit for a May 2025 cyber attack on the city of Washington Court House, Ohio. The attack disrupted city services including the local tax office, the water department’s payment processing system, and municipal court records.
On May 27, 2025, the city posted an announcement saying that phone, internet, and email access were disrupted at city administration, tax, and service departments. Some systems are back up and running, but the city is still restoring others as of late June. Some court records could not be recovered.
Beast says it stole 134 GB of confidential data from Washington Court House. To prove its claim, the ransomware group posted sample images on its website of what it says are documents stolen from Washington Court House’s government servers. They include personnel forms and tax documents.
Washington Court House has not verified Beast’s claim. City Manager Joe Denen said the city did not pay a ransom. We do not know what data was compromised, how much Beast demanded in ransom, or how attackers breached the city’s network. Comparitech contacted Washington Court House officials for comment and will update this article if it replies.
“All city departments have been affected by a network outage, hindering service to internet, email, and phone lines,” says the May 27 post from the city’s economic development Facebook account.
Who is Beast?
Beast is a new ransomware gang that made its presence known today by claiming credit for 16 attacks including this one on Washington Court House. 11 of those attacks hit targets in the USA. The group has an affinity for companies in construction and engineering, which account for five of its claims.
Beast operates a ransomware-as-a-service scheme in which affiliates pay to use Beast’s malware and infrastructure to launch attacks and collect ransoms.
In addition to Washington Court House, one of Beast’s other claims has been confirmed: it says it stole 600 GB from Hafnia Law Firm (PDF) in Denmark in February 2025.
Ransomware attacks on US government
Comparitech researchers have logged 45 confirmed ransomware attacks on US government entities in 2025 to date.
Six such attacks were confirmed in June. Ransomware group Inc claimed three of them on Durant, OK; Thomasville, NC; and Albemarle County, VA. Taos County, NM; Green River, WY; and Mower County, MN reported data breaches claimed by Kairos, Qilin, and an unknown attacker, respectively.
Last week, Qilin took credit for a May 2025 attack on Morgan County, AL’s 911 system. North Providence, RI notified 1,804 people of a May 2025 attack for which Medusa demanded $100,000.
Ransomware attacks on government entities can both steal data and lock down computer systems. The infected agency or department must pay a ransom to restore systems and for the ransomware gang to not release or sell stolen data. If the organization refuses, it faces extended downtime, permanent data loss, and putting data subjects at increased risk of fraud.
About Washington Court House
Washington Court House is the county seat of Fayette County, Ohio between Cincinnati and Columbus. It’s home to about 14,400 people.
