Bernalillo's town council has unanimously approved an offer of $82,000 to the hackers behind a ransomware attack that knocked out the Motor Vehicle Division office, disrupted police body cameras, and took down online water-bill payments. Most town services have come back online since, but residents still cannot pay their water bills online — they have to do it in person or by mail. The town has not yet made a payment, and officials admit that even if it does, there's no promise the attackers will hold up their end of the deal.
No Guarantee Even if the Town Pays
According to KOAT , the town council's vote was unanimous, and council members consulted outside experts before signing off on the offer. If the hackers accept, the $82,000 would be pulled from Bernalillo's general fund reserves. Assistant professor Efren Lopez told KOAT that paying does not guarantee the attackers will actually release a decryption key or restore operations — there's simply no way to force compliance from criminals.
Mayor Jack Torres said the town decided that making an offer was the fastest path forward rather than letting the standoff drag on, telling KOAT that the best way to move forward was to make an offer and try to get this resolved quicker. Even if an agreement is reached, the station reports the town still has no timeline for full recovery and would face significant additional recovery work regardless of what the hackers decide to do.
How the Attack Unfolded
The disruption began when the town's IT director discovered suspicious activity on Bernalillo's computer systems and started shutting down devices to contain the spread. Torres has said he later found a note left by the threat actors, which is when the town realized it was dealing with a full-blown ransomware attack rather than a routine technical glitch. Accounts of exactly when the intrusion started vary: KOAT has reported that key municipal services were disrupted starting October 16, while NM News reported that IT staff initially treated the attack, flagged to The Paper on Oct. 9, as a simple internet outage before its true scope became clear.
Per NM News, police and fire systems largely escaped the damage, aside from a brief delay affecting police body cameras. Bernalillo is also working with the FBI, the New Mexico Office of Cybersecurity and third-party experts to investigate the breach and restore remaining services, according to KOB .
Why Paying Hackers Is a Gamble
Efren Lopez, an assistant professor of computer science at New Mexico State University, told KOAT that paying a ransom effectively funds the attackers, saying you are funding the attackers and that they are getting money to continue their operations. He added that there's no guarantee hackers will release a decryption key or restore operations once money changes hands, even after a town meets their demands.
Still, Lopez acknowledged why municipalities make that bet anyway. He said some organizations decide the financial cost of staying offline outweighs the ransom itself, telling KOAT that the monetary cost of the operations being down is way more than the actual ransom payment. Lopez pointed to cybersecurity training and infrastructure investment as the real opportunity for Bernalillo to prevent a repeat attack down the road.
New Mexico's Pattern of Quiet Ransom Payments
Bernalillo isn't the first New Mexico government body to face this choice. Since 2020, more than two dozen government offices across the state have been targeted by extortion or blackmail schemes, and at least five public agencies have quietly paid ransoms, according to KRQE . New Mexico Tech reportedly paid $76,380 to recover encrypted earth-science data, while an insurance company covered a $185,000 ransom after the LockBit group shut down Rio Arriba County's computer system in May 2020. New Mexico's Insurance Office took a different route after a September 2023 attack, declining to pay a ransom but instead securing a $2 million special appropriation from the state legislature to fund recovery.
Outside New Mexico, Winona County, Minnesota offers another data point. County officials there negotiated and paid a $128,539.57 ransom after a cyberattack detected in January, saying in a statement reported by KTTC that leaders ultimately decided to pay the threat actors to ensure the resumption of vital public services and protect personal data.
Federal Warnings on Ransom Payments
Federal agencies continue to caution against following that path. The FBI's Internet Crime Complaint Center has said it does not encourage paying ransoms, warning that payment does not guarantee files will be recovered and can embolden adversaries or fund further illicit activity. The U.S. Treasury Department's Office of Foreign Assets Control has separately warned that facilitating a ransomware payment can carry sanctions risk, potentially enabling criminals or adversaries with a sanctions nexus to profit and advance illicit aims. The Cybersecurity and Infrastructure Security Agency's ransomware guide, meanwhile, emphasizes prevention and response planning for organizations trying to avoid landing in Bernalillo's position in the first place.
For now, Bernalillo residents are left in limbo: most town functions are running again, but water bills still require a trip in person or a stamp, and nobody — not the town, not outside experts, not the hackers — has said when that will change.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
