Ransomware Attacks Disrupt Services in Two Swedish Municipalities
Summary
Ransomware attacks disrupted municipal systems in Vilhelmina and Dorotea on April 9, 2026, prompting crisis measures and paper-based work. Dorotea said it paid no ransom; recovery timelines remain uncertain.
Key points
- Vilhelmina and Dorotea reported ransomware attacks on April 9, 2026, and filed police reports.
- Dorotea’s municipal systems were encrypted overnight; its municipal chief said no ransom had been paid.
- Vilhelmina’s website, e-services and telephone exchange initially failed; the exchange was restored that afternoon.
- Vilhelmina progressively shut down broadband for municipal network customers as a containment measure. Social services faced significant disruption.
- Dorotea used paper-based processes to maintain essential services, including home care and childcare; its broadband network was unaffected.
- Åsele also experienced limited internal system disruption, reportedly without impact on public services.
- Officials said recovery could take several weeks. No group claimed responsibility for the current attacks.
Article Details
- Victim Organization
- Vilhelmina and Dorotea municipalities; Åsele municipality was also affected to a limited extent
- Incident Type
- Ransomware attacks affecting municipal systems
- Incident Date
- 2026-04-09
- Operational Impact
- Dorotea's systems were encrypted overnight, and both Vilhelmina and Dorotea shifted to paper-based operations and activated crisis protocols. Vilhelmina's website, e-services, and telephone exchange initially failed; its exchange was restored by the afternoon. Social services faced major disruption. Åsele experienced internal system disruptions that did not affect public services. Full recovery could take several weeks, according to Dorotea's kommunchef.
- Ransom Or Extortion
- Dorotea's kommunchef said no ransom demand had been paid. The article reports no ransom demand or payment for the current incidents.
- Claim Status
- confirmed