Update: Fort Bend County Library Ransomware Attack

A local government system down for half a year, and the timeline is public.

The Fort Bend County Library ransomware attack was discovered around noon on February 24, 2025, took the catalog, accounts, and databases offline across all 13 branches, and was not fully resolved until the library website came back on September 2, 2025.

Attackers left a ransom note claiming files were encrypted and copied out, with instructions to reach a private portal. The Texas Department of Information Resources confirmed it as ransomware, not the "network disruption" county officials first described. For months, patrons could not log into accounts or search the online catalog. Staff searched shelves by hand. Homeschooling parents told ABC13 they needed hours instead of minutes to find books. The county waived late fees into November and kept accepting expired cards while it rebuilt. In one detail that should land for any owner: library staff first noticed the problem around noon but did not alert IT for nearly two hours.

• Discovery to full recovery: about six months. February 24 to a fully operational website on September 2, per Houston Public Media and county statements.
• Scope: the whole digital operation. Online catalog, account management, holds tracking, and licensed databases like the Wall Street Journal and LinkedIn Learning all went dark.
• Data exposure: the director says no sensitive patron data was stolen. The county's later statement is that patrons' sensitive information was not taken, though the ransom note claimed data was copied.
• Attribution: still open. As of late September 2025, investigators had not named a suspect or group. We are not going to guess at one either.

The post-attack risk assessment named problems any small business can find in its own network.

A post-attack risk assessment found that Fort Bend's library servers and computers carried public IP addresses reachable straight from the open internet, ran outdated and unsupported operating systems, and had no security monitoring. None of that is exotic. It is the exact list a managed IT provider works through in the first month.

The records also showed this was not the first warning. A cryptomining malware infection in November 2021 had already knocked out staff email for days, and IT recommendations from that incident may never have been carried out. Library requests for security tools, resources, and engineering hours were denied in budget cycles. The county's own separation between library IT and county IT created coordination gaps that slowed both prevention and response. After the attack, the county folded library IT under the county IT department. That reorganization is the tell: the problem was never a lack of clever technology, it was ownership.

• Servers on public IPs. Machines directly reachable from the internet were rated the single highest risk factor. Most SMBs have at least one service exposed this way and do not know it.
• Outdated and unsupported systems. Operating systems and hardware past their support window stop getting security patches, which turns known bugs into open doors.
• No monitoring. With no one watching, the two-hour gap between noticing trouble and calling IT is how a bad morning becomes a six-month rebuild.
• Ignored prior warning. The 2021 cryptomining hit was a free lesson. Skipping the follow-up recommendations is what made 2025 expensive.

A public agency had the excuse of budget cycles. A private business has fewer.

The lesson is not "libraries are careless." It is that the failures were mundane and the price was not. For a Houston SMB, a six-month outage is not a rebuild project, it is a closed business. The same public-IP, no-patching, no-monitoring gaps sit inside plenty of Katy, Sugar Land, and Cypress networks right now.

Fort Bend had something most small businesses do not: a $24 million operating budget and federal dollars to absorb a $5.8 million hit. A 40-person law firm, CPA practice, or construction company in Houston does not get that backstop. The 2021 cryptomining warning is the part that should sting most, because private businesses get the same early signals - a strange outage, a phishing near-miss, an alert nobody chased - and treat them as one-off annoyances instead of the free rehearsal they are. In 35 years doing this, the breaches that hurt most are almost never sophisticated. They are the basics somebody kept meaning to get to.

Two moves separate the organizations that recover in hours from the ones that recover in months. First, remove the standing exposure: get servers off public IPs, patch what is out of date, retire what cannot be patched, and put monitoring in front of all of it. Second, plan for the day it happens anyway - tested backups and a written recovery plan turn a ransom note into an inconvenience instead of a crisis. Fort Bend is now doing both, including moving its core Polaris catalog to a cloud service. Doing it before the attack costs a fraction of doing it after.