The counter was still open

The lights that matter to a resident stayed on. The desk where the city takes a utility payment did not.

Mayor Willis Thompson said the City of Vicksburg was hit on Thursday, 1 October, and that internet-facing operations were brought down for protection. Local reporting, written up again today, says 911, police, and fire were not stopped. Water and gas service continued. In-person payments for a utility base of more than 10,000 accounts may wait. The city said there would be no penalties and no shutoffs while the system is down. It is working with outside specialists. It has not named a ransomware group, a malware family, a demand, or a door. It has not said whether personal data was accessed. DataBreaches.net noted that, as of today, it is still unclear whether files were encrypted or whether what arrived was a demand.

That uncertainty is the incident status. “Ransomware” in a mayor’s sentence can mean a note, a locker, or both. Treating it as a locker will send people to backups. Treating it as only a note will send them past the question of whether a copy left.

What “emergency services are up” will be asked to cover

It covers dispatch. It does not cover the utility ledger, the employee file, or the vendor list that lived on the machines they chose to unplug. A city that can still roll a fire truck has not answered a resident who wants to know if a bank draft or an account number moved. The promise of no penalties is an operational kindness. It is not a forensic finding.

If you are watching this as a peer city, the useful part is the split they already made: life safety on one network, payments on another, and an honest blank where the group’s name would be. Fill the blank with evidence. Do not fill it with whichever leak site posted a municipal name this week.

The counter being closed is the fact a resident can see. Whether anyone copied the book under it is the fact they cannot.