Short answer
Heber City, Utah said a cyberattack on 10 October 2026 breached its local IT network. The city says its team contained the attack quickly, that systems are secure and back online, and that essential services were never suspended. The FBI is assisting with a forensic investigation, and the city has not said what data was involved.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Heber City Municipal Corporation |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Municipal government |
| Country | United States |
| Detected | 2026-10-10 |
| Disclosed | 2026-10-15 |
| People or records affected | Not stated. The city has not said what, if anything, was compromised |
What data was exposed
- Not stated. KPCW reported on 16 October that it was unclear what, if anything, was compromised
- The city said its cloud-based website and online bill pay were not affected
What happened
Heber City, Utah, said a cyberattack targeted and breached the local IT network of the Heber City Municipal Corporation on 10 October 2026. KUTV reported it on 15 October, and KPCW followed on 16 October.
A city spokesperson told KUTV that the IT team was alerted and “took steps to stop and contain it expeditiously,” and that there was no concern about further spread. The city said its municipal systems were secured and back online by Thursday 15 October.
What the city says is unaffected
The city’s website is cloud-based and was not affected, according to the spokesperson. No essential services were suspended. The spokesperson told residents they could use online bill pay and other services on heberut.gov “with full confidence.”
Investigation
The FBI is assisting with a forensic investigation. Neither KUTV nor KPCW reported the type of attack, who was responsible or how much data was involved. KPCW wrote that it is unclear what, if anything, was compromised, and its report included no direct quotes from named officials.
The attacker claim
Comparitech’s October 2026 ransomware roundup lists Heber City as confirmed and attributes the claim to the Qilin ransomware group. That is the group’s claim as recorded by Comparitech. The city has not confirmed who was behind the attack or whether ransomware was involved, and has not said whether any data was taken or published.
What residents should do
There is no confirmation yet that personal data was exposed, so there is no formal breach notice. Two practical risks remain. First, scammers like to send messages that mention a town’s attack and ask people to log in or pay a bill through a look-alike link. Second, if the investigation finds that names, addresses or account details were taken, later phishing could use them. Our guide to utility and energy bill scams explains the fake bill and shutoff scripts, and the guide to government impersonation scams covers fake city notices.
If the city later confirms data exposure, follow our data breach checklist and check unexpected links against our guide to phishing messages.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake Heber City emails or texts about a breach that ask you to log in to 'verify' your utility or city account.
- Look-alike payment pages for water, sewer or other city bills that copy the real heberut.gov site.
- Follow-up phishing aimed at residents or staff if names or email addresses turn out to be involved.
What to do if you are affected
- 01Pay city bills only on the official heberut.gov address, typed yourself, as the city says its site is safe to use.
- 02Ignore unexpected messages that mention the cyberattack and ask for a password, card number or Social Security number.
- 03If you receive a notice from the city about personal data, follow the steps in that letter and not links in an email.
- 04Use unique passwords and multi-factor authentication on any city account you hold.
Frequently asked questions
What happened to Heber City?
The city says a cyberattack breached its local IT network on 10 October 2026. A city spokesperson told KUTV that the IT team was alerted and took steps to stop and contain it expeditiously, with no concern about further spread.
Is my data at risk?
Unknown. KPCW reported that it was unclear what, if anything, was compromised, and the city has not said what data was involved. The FBI is assisting with a forensic investigation. Watch for a notice from the city.
Is it safe to pay city bills online?
The city says so. A spokesperson told KUTV that residents may use online bill pay and other services on heberut.gov with full confidence, because the cloud-based website was not affected and no essential services were suspended.
Did a ransomware group claim it?
Comparitech's October ransomware roundup lists the Qilin group as claiming the attack. That is an attacker claim, and the city has not confirmed who was responsible or whether ransomware was used.
Sources
- Cyberattack targets, breaches Heber City's system, KUTV, 2026-10-15
- Cyberattack breaches Heber City IT network, KPCW, 2026-10-16
- Ransomware roundup: October 2026, Comparitech
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.