City of Attleboro data breach: a month inside the city's systems, and letters eleven months later

Date	Event
October 22, 2025	Start of the unauthorized activity the investigation found
November 20, 2025	City finds suspicious activity; email down citywide and most phone lines out
September 22, 2026	Data review finds individuals' information may be involved
October 15, 2026	Report to Massachusetts (2026-1795): 2,634 residents
October 19, 2026	Notice of Data Event posted on the city's website

What happened in the Attleboro cyberattack?

On November 20, 2025, the city identified suspicious activity across its computer systems and brought in third-party forensic specialists. The effect was visible the same day. NBC Boston reported that afternoon that several city systems were offline, that email was down citywide, and that every phone line for the city and the police department was out except the police and fire business lines. The city said it was working with cybersecurity specialists, its insurer and state and federal partners. City Hall stayed open on paper forms and offline payments, and 911 kept working.

What the investigation later found is that the intruder had been inside for about four weeks before anyone noticed: the activity began on October 22. Neither the notice nor the letter says how the intruder got in, whether files were encrypted, or whether a ransom was demanded.

What information was exposed in the Attleboro breach?

The city's list is one of the longest in a municipal notice: name, Social Security number, financial account information, driver's license and passport numbers, other government ID numbers, date of birth, medical and health insurance information, taxpayer ID, biometric information, electronic signature, and username and password. What any one person lost depends on the records the city held about them. The Massachusetts letter fills that in per person and says Massachusetts law keeps the city from giving more detail about the event in the letter itself. That is why the website notice tells the story and the letter does not.

Record	Residents	Data it marks
Massachusetts OCABR, report 2026-1795	2,634	Social Security numbers, medical records, financial accounts, driver's licenses

Who is getting an Attleboro breach letter?

People whose information was in the data at issue and for whom the city has a mailing address. The notice says anyone who did not get a letter but thinks they were affected can call the assistance line. The notice does not say whether the 2,634 Massachusetts residents are city employees, residents who deal with city departments, or both.

What is Attleboro offering?

The letter offers 24 months of credit monitoring and identity restoration through Epiq, with an enrollment deadline printed in each letter. The assistance line, 888-752-8537, is open Monday to Friday from 9 a.m. to 9 p.m. Eastern; letters can go to City of Attleboro, Cyber Incident, 77 Park St, Attleboro, MA 02703. WJAR NBC 10 reported the notice on October 20, 2026 and repeated the city's advice to place fraud alerts and credit freezes. Because usernames and passwords are on the list, changing any password shared with a city account is the first step.

Why did the letters take eleven months?

The notice describes the gap but does not explain it beyond the data review: a third-party specialist went through the data, and that review ended on September 22, 2026, ten months after the intrusion was found. Letters followed within weeks. The notice delay guide compares this gap with other notices. For how other towns and cities have written these letters, see the government breach notice guide, and for another Massachusetts city's breach this year, the City of Peabody entry.

What the documents leave open

• How the intruder got into the city's systems, and whether the outage was ransomware.
• The total number of people notified; Massachusetts counts its own residents only.
• Whether the people affected are residents, employees or both.