City of Cocoa and Florida: City Of Cocoa Hit With Ransomware Cyberattack

Ransomware Group Claims Attack on City of Cocoa, Florida, as Officials Cite "Technical Issues"

On February 23, the ransomware group INCRansom listed the City of Cocoa, Florida, as a victim on its leak site, Ransomware.live, which tracks extortion group activity. Despite the claim, city officials have not confirmed a cyberattack, referring to the incident only as a "technology disruption."

The disruption first emerged on February 16, prompting the Cocoa City Council to convene an emergency meeting the following day. They approved a declaration granting leadership expanded authority to allocate funds and mobilize staff for recovery efforts. The city is working with external cybersecurity specialists to assess and resolve the situation.

While emergency services, including 911 dispatch, remain operational, several municipal systems have been impacted. Key disruptions include:

• Suspended cash payments for water bills (online, phone, and check payments remain available).
• Delayed delinquency processing and waived late fees.
• Inaccessible online water service requests, forcing residents to submit paper applications in person at City Hall with proper documentation.
• Business Tax Receipt submissions limited to in-person processing.

The city has assured residents that water meter readings continue as scheduled, and non-emergency police assistance remains available via phone. The full extent of the incident and whether it involves ransomware remains unconfirmed by officials.

Source: https://talkoftitusville.com/2026/02/24/city-of-cocoa-hit-with-ransomware-cyberattack/

City of Cocoa, Florida TPRM report: https://www.rankiteo.com/company/city-of-cocoa

"id": "cit1771963282",
"linkid": "city-of-cocoa",
"type": "Ransomware",
"date": "2/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': 'Residents and businesses in '
                                              'Cocoa, Florida',
                        'industry': 'Municipal Services',
                        'location': 'Cocoa, Florida, USA',
                        'name': 'City of Cocoa, Florida',
                        'type': 'Government'}],
 'customer_advisories': 'Residents advised on alternative payment methods and '
                        'in-person service options.',
 'date_detected': '2024-02-16',
 'date_publicly_disclosed': '2024-02-23',
 'description': 'The ransomware group INCRansom listed the City of Cocoa, '
                'Florida, as a victim on its leak site. City officials have '
                'not confirmed a cyberattack, referring to the incident as a '
                "'technology disruption.' Several municipal systems were "
                'impacted, including suspended cash payments for water bills, '
                'delayed delinquency processing, and inaccessible online water '
                'service requests.',
 'impact': {'operational_impact': 'Suspended cash payments for water bills, '
                                  'delayed delinquency processing, and limited '
                                  'in-person services for water service '
                                  'requests and Business Tax Receipts.',
            'systems_affected': ['Water bill payment systems',
                                 'Delinquency processing',
                                 'Online water service requests',
                                 'Business Tax Receipt submissions']},
 'investigation_status': 'Ongoing',
 'references': [{'date_accessed': '2024-02-23',
                 'source': 'Ransomware.live',
                 'url': 'https://ransomware.live'}],
 'response': {'communication_strategy': 'Public advisories on service '
                                        'disruptions and alternative payment '
                                        'methods.',
              'third_party_assistance': 'External cybersecurity specialists'},
 'stakeholder_advisories': 'City Council granted expanded authority for '
                           'recovery efforts.',
 'threat_actor': 'INCRansom',
 'title': 'Ransomware Attack on City of Cocoa, Florida',
 'type': 'Ransomware'}