Delaware County, Pennsylvania is now three weeks into a cyber incident that shut down its Government Center — and as of a July 15 deadline, county officials still won't say publicly whether it was ransomware, whether data was stolen, or whether a ransom was demanded. For small-business owners across Pennsylvania, this is a case study in how a real breach unfolds in slow motion, and how quickly a shutdown decision can freeze everyone doing business with the affected organization.
What actually happened
Delaware County Council first disclosed a "network outage" affecting the Government Center Complex in Media on June 26, offering no explanation of cause and making the disclosure on Facebook. By July 2, the county's public characterization had escalated from "network outage" to "unauthorized activity" to "intrusion attempts," while declining to say whether the incident involved a hacker, ransomware, or a specific threat actor.
The county said it responded by taking the proactive but necessary step of shutting down its network to protect sensitive information and critical systems while following industry best practices in response to the intrusion attempts. On July 10, a county Facebook statement confirmed for the first time that data had been accessed and that outside cybersecurity counsel and forensic specialists had been engaged — while still avoiding the word "ransomware" and offering no detail on what categories of data were accessed or how many people might be affected.
On Tuesday, July 15, the Delaware County communications office refused to answer a direct yes-or-no question on whether the attack was ransomware, and a 2 p.m. deadline for a response came and went with no answer.
Why this matters to a small business in York County
Delaware County is a government, not a plumbing contractor or a dental office — but the mechanics of the incident are exactly what a small business faces. A network gets touched by an attacker. The organization pulls the plug to contain the damage. Everyone who depends on that network stops working.
One real estate broker and appraiser said the situation has complicated his business because the Delaware County Courthouse has been shut down for a couple of weeks, leaving his job at a standstill. That's the ripple effect: when a customer, supplier, county recorder, or vendor of yours gets hit, your revenue can freeze even if your own systems are clean.
The second lesson is disclosure. Pennsylvania law's breach-notification requirements are triggered by unauthorized acquisition of personal information , and the longer an organization waits to confirm what happened, the more legal and reputational exposure it accumulates. A prepared incident-response plan — the kind included in our managed IT services lineup — decides in advance who talks, who calls counsel, and who calls the insurance carrier, so day one doesn't turn into three weeks of Facebook updates.
What your managed-IT provider should already be doing
If you're paying an MSP, the Delaware County situation should trigger a short checklist on their end this week:
- **Segmented backups tested in the last 30 days**, stored where ransomware can't reach them. Not just "we have backups" — a documented restore test. - **MFA on every admin account, VPN, email login, and remote-access tool.** No exceptions for the owner or the bookkeeper. - **Endpoint detection and response (EDR)** actively monitored, not just installed. Someone should be looking at alerts at 2 a.m. - **A written incident-response runbook** that includes who has authority to disconnect the network, who notifies employees and customers, and who contacts the breach coach on the cyber policy. - **Vendor risk review.** If a key vendor of yours got hit like Delaware County did, how long could you operate?
If you have an internal IT person who's stretched thin covering day-to-day tickets, that's exactly the gap co-managed IT support is built to fill — 24/7 monitoring and after-hours coverage layered on top of the person you already trust.
What York Businesses Should Do
York County small businesses that share vendors, courts, or recorders with Delaware County offices should confirm this week that their own backups, MFA, and incident-response plan can survive a two-to-three-week outage of a critical partner. If you're not sure where you stand, York Computer can walk through the checklist with you.