Meriden City Network Still Offline Weeks After February Cyber Incident

Meriden City Network Still Recovering Weeks After Cybersecurity Incident

Nearly three weeks after a cybersecurity incident forced Meriden to take its city network offline, the city continues to operate on a partially restored system, with full service restoration potentially still weeks or months away.

The incident began on February 17, 2026, when city IT workers detected what officials described as an "attempted interruption" of internet services. Mayor Kevin Scarpati authorized a full network shutdown as a precautionary measure to contain the threat. Since then, all city departments have been operating without full internet access.

The incident was not classified as ransomware, according to officials. Police are investigating.

Impact on City Services

The disruption affected virtually every department in Meriden's government. Employees across City Hall were forced to record transactions and data manually. Residents seeking to pay taxes or fees were restricted to paying by bank check only -- credit cards and electronic payments were unavailable.

The Meriden Public Library was among the hardest-hit public-facing services. Signs went up at library computers reading "No internet, no computer, no scanning, no fax, no print." Caution tape blocked off dozens of workstations that rely on city network connectivity. For residents who use the library as their primary point of internet access -- including those without home internet service -- the closure of the library's technology resources cut off access to employment applications, government services, and other essential online functions.

City Council committee meetings were also affected, with live-streaming of proceedings suspended during the outage.

Emergency Services

Meriden's emergency dispatch center was among the most critical systems to be protected and restored. The state offered to provide 911 support, and the city temporarily relocated its emergency dispatch operations to the Connecticut State Police Academy during the disruption. Police and fire departments continued to operate throughout the incident, maintaining emergency response capabilities.

The relocation of dispatch to a state facility reflects the severity of the network disruption and the city's need for external support to maintain public safety communications during the recovery period.

Restoration Progress

City officials have been working to restore network access methodically. As of the most recent update, key employees have had email access partially restored, and the city has been able to post the City Council agenda and the proposed 2027 municipal budget online.

City Manager Brian Daniels described the restoration process as painstaking and difficult, saying only that the city is "doing the best we can." Mayor Scarpati offered a similar assessment, saying the city would "try" to restore services. Full restoration of the network across all departments remains without a confirmed timeline.

Cybersecurity experts note that restoring municipal networks after a disruption incident can take weeks to months, depending on the nature of the attack, the extent of the investigation, and the need to verify system integrity before reconnecting individual functions to avoid reintroducing a threat.

What Is Known About the Incident

City officials have been limited in their public disclosures about the technical nature of the incident. What is known is that Meriden's IT department detected an interruption attempt, took the network offline preventively, and notified state authorities.

The investigation remains ongoing. No group has publicly claimed responsibility, and no specific details about how the intrusion was attempted have been released.

Municipal cybersecurity incidents have become increasingly common across the United States, with cities of all sizes targeted by hackers seeking to disrupt operations, steal data, or extort municipalities for ransom payments. Meriden's decision to go offline preemptively -- rather than waiting for a confirmed breach -- reflects the approach security experts recommend when an anomaly is detected.

Got a tip? Reach out to us at tips@thequinnipiacpost.com.