Passaic County cyberattack costs $390K
No ransom was paid, but experts were hired
By: David M. Zimmer
NorthJersey.com
USA Today Network - New Jersey
..... Passaic County's cost after a March [2026] ransom-ware attack is approaching $395,000 after commissioners approved nearly $147,000 for cybersecurity and recovery work in July. [2026]
.....
The new allocation comes as county officials confirmed that the attackers accessed and obtained data from county systems and demand a ransom. However, no payment was made by the county, its insurer or anyone working on its behalf, they said.
..... County records say suspicious activity was detected around March 4. [2026] The attack left the county's network, including its phone systems, computers and Internet service, inoperable. Records included in the July 14 [2026] commissioners' agenda describe it as a "Ransomware Event."
.....
The network has since been restored and the forensic investigation is complete, county spokesperson Lindsay Reed said. A separate review of the data remains underway to determine which records and information were involved, she added.
..... County officials have not said how much data was taken, whether any of it was posted Online or how many employees, residents or others may be affected.
.....
Commissioners approved the latest funding on July 14 [2026] for MOXFICE, a cybersecurity firm hired during the initial response. The increase brings the firm's contract to more than $304,000.
..... MOXFIVE helped restore county systems and conducted a forensic analysis under the direction of outside legal counsel, Reed said. The company is also review the data involved so the county can determine whether it must notify people whose personal information was taken or meet other legal requirements, she added.
..... The county initially authorized $149,375 for MOXFIVE and $8,250 more for the firm obtain information from the dark web. Reed said the information was used in the forensic investigation but provided no further details.
..... Another $75,000 was authorized for BakerHostetler,a law firm brought in to advise the count, and $15,000 for CyberSeward. which communicated with the attackers, county records show.
..... Reed declined to discuss those communication or disclose the amount of the ransom demand but confirmed that neither the county nor its insurer made a payment.
.....
Together, the contracts bring the amount authorized for the response to nearly $395,000. the county did not say how much has been paid or whether additional expenses are expected.
.....
Passaic County has cybersecurity insurance through AUG and is pursuing a claim under the policy, which county records show has a $150,000 deductible. the July [2026] resolution says the latest MOXFIVE expenses are expected to be covered, things the county must pay them while the claim is pending.
..... Reed said the county is working with tis carrier to obtain the maximum available coverage but did not say how much it expects to recover.
.....
The FBI has warned that ransomware attacks increasingly combine prolonged system outages with the theft of data, allowing attackers to threaten the release of sensitive information even when a victim can restore its network without paying.
..... Other New Jersey governments have spent months reviewing files after similar attacks.
..... Hoboken discovered a ransomware attack in November 2024 that disrupted city operations and closed City Hall. The city later determined hat files had been accessed and may have contain Social Security numbers and banking information.
..... Perth Amboy disclosed a network security incident in November 2025. In June [2026] update, the city said an unauthorized actor had accessed or obtained files that may have contained Social Security numbers, financial and credit card information, identification numbers and account credentials.