Sutton and Fort Smith Hit by Ransomware

Update September 24, 2026: Interlock has now claimed it obtained 5,720 gigabytes, or about 5.7 terabytes, of data from the City of Fort Smith. The rest of the coverage remains unchanged, with Sutton investigating the impact on its network and Sutton Public Schools, and Fort Smith maintaining that the incident was contained.

The Town of Sutton, Massachusetts, and the City of Fort Smith, Arkansas, were named in ransomware incidents attributed to the Global and Interlock groups. Sutton confirmed a cyber incident that affected parts of its network and Sutton Public Schools, while Fort Smith said the attack was contained and that it had already identified how the actor got in and what information was accessed.

What happened in Sutton?

Sutton said it detected a cyber incident that affected portions of its network environment and that it took immediate steps to secure systems. The town also said it hired independent cybersecurity and forensic specialists, notified law enforcement, and kept services running while the investigation continued.

The city added that the scope included municipal networks and Sutton Public Schools. The Boston Globe and WCVB reported that local technical teams worked to contain the incident, reduce operational impact, and add further security controls.

In parallel, the Global group was publicly linked to the case. Dexpose said it posted an extortion notice and threatened to leak data if it did not hear from a representative, while HookPhish linked the incident to the official suttonma.gov site.

How did the Fort Smith case evolve?

Fort Smith said its forensic investigation was close to wrapping up, that the threat had been contained, and that it had already identified the access vector and the scope of the compromised information. According to Talk Business & Politics, the attack originated with the Fort Smith Police Department.

That coverage also said data was exfiltrated and that several systems had already been restored, including payments at City Hall, Fort Smith District Court, and the Fort Smith Landfill. Ransomware.live also listed the city as a victim attributed to the Interlock group under the official fortsmithar.gov domain.

On September 17, Fort Smith said it was reviewing files from a dark web post that claimed to contain data copied from the city and police networks. The local administration said it could not yet comment on the contents because the analysis would take time and resources.

The city also said that post did not affect network security or recovery efforts, and that public-facing services remained online.

Interlock also claimed to have obtained 5,720 gigabytes, or about 5.7 terabytes, of data from the city.