Everett City Hall has been closed to the public for a week. The city discovered what it calls a “cybersecurity incident” affecting its internal network and technology systems on the evening of Sunday, September 6. City Hall did not open Tuesday, the closure was extended through Thursday, and it has now been extended again through Thursday, September 17. Basic services are running out of the Connolly Center at 90 Chelsea Street, and residents are being told to call 311. The city has not said what happened, who did it, whether resident data was taken, or when the building will reopen.
This guide covers what an Everett resident can and cannot do during the closure, what the city has and has not disclosed, what Massachusetts law will require the city to tell you if personal information was exposed, and what the pattern of municipal cyberattacks across the state, including the Springfield schools shutdown the same week, says about how this is likely to end.
Everett City Hall closure: what is open and where
The city’s notice says City Hall building operations are suspended through September 17. The following continue to operate normally:
- Everett Police Department, Fire Department and 911
- Department of Public Works
- Everett Public Schools
- Everett Public Libraries
- Third-party online payment systems, which the city says were not affected
Basic municipal services have been moved to the Connolly Center, 90 Chelsea Street, 9 a.m. to 5 p.m., with parking in the Spring Street stadium lot and a handicap-accessible rear entrance. Departments staffed there:
- Treasurer and Collector
- Assessor
- City Clerk, including in-person transactions
- Engineering
- Auditing
- Procurement
- Inspectional Services
- Housing Assistance
- Parking
Building permit applications and certain payments remain available online. For anything else, the city’s instruction is to call 311.
What the notice does not say is which functions are actually impaired. A department “operating” from a folding table at the Connolly Center may or may not be able to reach the records it needs. Vital records, tax lookups, permit histories and licensing files typically live on the systems that are down. Residents with time-sensitive business, such as a closing that needs a municipal lien certificate, a permit inspection with a contractor waiting, or a license renewal with a deadline, should call 311 first and ask specifically whether the department can complete the transaction, not merely whether it is open.
What the city has said, and what it has not
Mayor Robert J. Van Campen’s statements have been consistent and brief. “Our priority is to ensure the security of our systems and infrastructure while also investigating the full scope of the incident.” “Our IT professionals and investigators are working around the clock to restore City operations as quickly and safely as possible.” “We know a City Hall closure creates an inconvenience for our residents, and we appreciate their patience while our team works through this. We will continue to be transparent with the community as we learn more and will take the necessary steps to make sure our systems are stronger and more secure moving forward.”
The notice says “cybersecurity professionals and appropriate governmental and law enforcement partners are working to determine what occurred and which systems were affected.” The Everett Police Department is named. No state or federal agency is named, and the city has not used the words ransomware, breach, or data.
That silence is standard in the first days of an incident, and it is usually deliberate. Legal counsel and insurers advise against characterizing an attack before forensics are complete, and the attacker may be reading the statements. It does not mean nothing was taken. It means the city does not yet know, or is not yet saying.
What a week-long closure usually means
A power failure or a botched upgrade takes a city hall down for a day. A closure that runs past a week, with the network rebuilt from outside and police involved, is the signature of a ransomware or intrusion event in which the city has taken its own systems offline to contain the damage and is restoring them from backups, if the backups survived.
Everett is not alone this month. Springfield Public Schools detected “intermittent disruptions” on September 2, escalated to what officials called “malicious cyber traffic” on September 6, the same weekend as Everett, and closed schools through September 12 after an outside group blocked access to online programs and school nurses lost access to student medical records. Springfield classified it as a Level 4 severe incident, and Mayor Domenic Sarno has said the city will pay “not one dime” to the attackers. Earlier this year the LockBit ransomware group claimed an attack on the Town of Hanover, and this weekend a ransomware tracking site listed the Town of Sutton as a claimed victim of another group. The MassCyberCenter, the state’s municipal cybersecurity arm, has spent the year convening town officials on exactly this problem.
The former FBI cyber official Cynthia Kaiser, now at a ransomware research center, put it to CBS Boston this way: “I would expect to see more of these types of attacks in the future because it’s getting easier to actually get onto a network.”
What the city must tell you if your data was taken
Massachusetts’s data breach law, chapter 93H, applies to municipalities as it applies to businesses. It is triggered when an entity that owns or licenses “personal information,” meaning a resident’s name combined with a Social Security number, driver’s license number, or financial account or card number, “knows or has reason to know of a breach of security” or that the data was acquired or used by an unauthorized person.
When that happens, the city must give notice “as soon as practicable and without unreasonable delay” to three parties: the Attorney General, the Director of Consumer Affairs and Business Regulation, and every affected resident. The notice to residents must state the right to obtain a police report, how to place a security freeze on a credit file and that there is no charge for one, and what mitigation services are being offered. If Social Security numbers were involved, the city must provide credit monitoring for at least 18 months.
A city hall holds a great deal of personal information that qualifies. Excise and property tax records carry names and addresses, and payment records carry account numbers. Licensing files carry driver’s license numbers. Employee records carry Social Security numbers for every city worker, teacher and retiree. Housing assistance files carry all of it. If the attacker exfiltrated any of those before the systems went down, notice is coming, and the Attorney General’s public list of breach notifications is where it will first appear.
The law does not set a fixed number of days. “Without unreasonable delay” has been read by the Attorney General’s office to permit the time genuinely needed to determine scope, but not the time it takes to finish a full forensic report. A city that knows a file server was copied cannot wait months to say so.
What you can do now
- Freeze your credit. It is free under Massachusetts law at all three bureaus, takes minutes, and does not require waiting for a notice. If your Social Security number was on a city system, this is the single most useful step.
- Watch for phishing. Attackers who obtain a city’s email or resident lists use them. A message that appears to come from the City of Everett asking you to pay a bill, confirm a permit, or update payment information should be verified by calling 311, not by clicking.
- Keep records of any deadline you cannot meet. A tax payment, license renewal or permit deadline that falls during the closure and cannot be completed because of it is a deadline the city should extend. Ask for the extension in writing and keep the response.
- Pay online if you can, by check if you must. The city says online payment platforms are unaffected. A check mailed to City Hall may sit; a check delivered to the Connolly Center will be logged.
The larger question for Everett
Everett is a city in transition. Mayor Van Campen took office in January after Carlo DeMaria’s long tenure, inherited a host community agreement with Encore Boston Harbor that we covered in our analysis of the city’s leverage over the casino, and now has a strike at that casino and a City Hall that has been dark for a week. The cost of a municipal ransomware recovery routinely runs into seven figures once forensics, rebuilding and legal notice are counted, and municipal cyber insurance, where a city has it, comes with deductibles and exclusions.
The city’s promise to “be transparent with the community as we learn more” is the one to hold it to. The questions residents are entitled to have answered, when the city knows them: what was the incident, what systems were reached, was data taken, was a ransom demanded and was it paid, and what it will cost.
Is Everett City Hall open?
No. City Hall is closed to the public through at least Thursday, September 17, 2026, because of a cybersecurity incident discovered September 6. Basic services are available at the Connolly Center, 90 Chelsea Street, 9 a.m. to 5 p.m., and by calling 311.
What happened to Everett’s computer systems?
The city says a cybersecurity incident affected its internal network and technology systems. It has not said whether it was ransomware or whether data was taken. Police and cybersecurity professionals are investigating.
Can I still pay my Everett tax or water bill?
Yes. The city says its third-party online payment platforms were not affected. Payments can also be made in person at the Connolly Center.
Can I get a building permit or a birth certificate during the closure?
Building permit applications are available online, and the City Clerk and Inspectional Services are staffed at the Connolly Center. Call 311 first to confirm the specific transaction can be completed, since some records may be on affected systems.
Will the city tell me if my personal information was exposed?
Massachusetts law, G.L. c. 93H, requires notice to affected residents, the Attorney General and the state consumer affairs office without unreasonable delay if a name combined with a Social Security, license or financial account number was accessed. The notice must explain how to place a free credit freeze.
Which Massachusetts communities have had cyberattacks recently?
Springfield Public Schools closed for more than a week in September 2026 after an intrusion. Ransomware groups claimed attacks on the Town of Hanover in February 2026 and the Town of Sutton in September 2026. Everett’s incident began September 6.
City notices from cityofeverett.com, September 7 through 14, 2026. Statements and incident details as reported by CBS Boston, Boston.com, Boston 25 and The Boston Globe, September 7 through 9, 2026. Springfield details from Boston.com, September 9. Ransomware group claims from public tracking sites and are unverified by the towns. Statutory text of G.L. c. 93H, § 3 read at malegislature.gov. General information about Massachusetts law, not legal advice.