Lubbock disclosed two attacks to government officials this year – not just one.
Less than a week after a cyber attack shut down Lubbock’s online presence, the City Council meets Monday evening for a closed-door meeting on “security audits,” information technology and “critical infrastructure.”
Over the weekend, state officials revealed new details about the cyber-attack – which was not the only security incident in recent months with the city’s online sites. Nearly nine months ago the city’s utility site was attacked, but city officials said to their knowledge no one’s data was accessed.
The Texas Attorney General published a “catastrophe notice” on Saturday. Catastrophe, in this case, is a technical term.
“The City of Lubbock experienced a cyber attack beginning Tuesday, August 12, 2025, which resulted in the shutting down of all systems and our resources for fulfilling Public Information Requests. IT is working diligently to restore systems and it is expected to take multiple days up to a week,” the notice said.
The cyber-attack began on August 12 and full restoration of computer systems would be Monday (August 18), the notice said.
LubbockLights.com reached out to the city on Friday – three days after the incident began and was told by city spokesperson Lacey Rose, “Everyone that would be the best to speak to on this are extremely busy.”
The first public notice of the cyber attack was Tuesday, when the city posted on social media, “The City of Lubbock has temporarily taken its systems offline to evaluate a potential security concern. We have protocols in place for issues such as this and we are following our process.”
A later statement said, “The City of Lubbock continues to follow protocols, and industry best practices to gradually bring its systems and network back online. These systems were taken offline by the City yesterday [Tuesday] out of an abundance of caution.”
That same statement said residents needed to pay their city utility bills in person, not online.
“The City will provide another update tomorrow morning,” it said.
But LubbockLights.com was unable to find an update on the city’s website or Facebook page. We were also unable to identify an update from the city’s emailed press releases.
LubbockLights.com reached out to two city officials on Sunday after the state notice was posted. We continued to reach out to more officials Monday, and we will provide updates as soon as we can.
Earlier this year, Lubbock filed a notice of data breach with various government agencies.
Nearly nine months ago, according to a notice of data breach, “… A malicious actor had created a fake pop-up window on the COLU [City of Lubbock Utilities] payment website, which requested credit card payment information from users.”
A copy of the letter Lubbock sent to consumers to notify them of the breach was filed with the attorney general of Vermont, which posted a copy online. It provided more details than other public notices including the one posted online in Texas.
Customers trying to make payments were directed to the fake pop-up window between December 18, 2024, and January 6, 2025, according to the letter.
“Although the City has accounted for all payments made during this period and no payments were delayed, this incident may have allowed the malicious actor to collect payment card information from individuals who entered their details in the fake pop-up window during this timeframe,” the consumer letter said.
The Texas notice (published by the state in April) said the “number of Texans affected” was 12,503. But the various notices did not specify if that was the number of people who visited the website or the number of people who might have encountered the pop-up.
The consumer letter said, “When the City discovered the issue, it promptly disabled the COLU payment website to address the issue and engaged third-party cybersecurity specialists to investigate.”
It also said a search of the dark web did not reveal anyone’s information getting exposed.
The city offered a period of free credit monitoring to people who received the consumer notice.
