Andover has appeared on a dark-web victim list tied to the WallStreet ransomware group, a cybersecurity news site reported. The listing links the group to the town's August cyberattack.

Undercode News reported Sunday, Aug. 30, that Andover surfaced on a WallStreet group victim list found through dark-web monitoring. The report described the listing as suggesting "local systems may be under criminal pressure even as technical details remain scarce."

The town has not confirmed the identification.

The listing is the first public indication of who may be behind the cyberattack first detected Aug. 13, which knocked out town and school networks for four days. At the time, Town Manager Andrew Flanagan did not identify who was responsible, how attackers gained access, or whether ransomware was involved.

Flanagan confirmed the cyberattack in an Aug. 22 email, as Andover News first reported. It also remained unclear whether any town or school data had been accessed, copied or compromised.

"The Town continues to work with its cybersecurity and legal professionals and is following all applicable legal, technical and notification requirements," Flanagan said on Aug. 22.

The attack disrupted town departments and Andover Public Schools, delayed the release of teacher assignments to families before the school year, and temporarily blocked residents from accessing email and online bill payments. Town buildings stayed open and public safety agencies were not interrupted. By Monday, Aug. 17, most systems were restored.

The August incident came less than a year after a separate cybersecurity breach involving CodeRED, the third-party emergency notification system used by the town. That earlier breach was within CodeRED's platform, not Andover's own network. Compromised information was limited to deactivated passwords last used before 2015.

Undercode News, which published two articles on the WallStreet listing, is a cybersecurity aggregation site whose articles carry the byline "Humanoid Deep Analyser," indicating AI-assisted authorship. The site's reporting has not been independently confirmed by town officials or law enforcement.

No Select Board agenda item or public meeting related to the ransomware incident has been announced. The investigation remains ongoing.