On the morning of July 27, 2020, in the early months of the COVID-19 pandemic, Lafayette, Colorado faced a crisis unlike any it had encountered before—one with no visible damage, no emergency sirens, and no visible signs of disruption on the streets.

The threat was digital, silent, and deeply seated into our technologies by the time employees powered up their computers. A ransomware attack had infiltrated the city’s network, abruptly locking staff out of essential systems and shutting down services that thousands of residents relied on daily.

For the city’s leadership, the moment represented more than a technical malfunction. It was a test of crisis management, organizational resilience, and decision-making under intense uncertainty. And, as with so many modern threats, it arrived without warning.

When the Digital Becomes Operational

The city first noticed trouble shortly before 2:00 A.M., when routine logins failed and screens displayed the unmistakable signs of file encryption. Within minutes, email and phone networks were inaccessible, online payment portals shut down, and key internal applications went dark.

From a leadership perspective, the incident revealed a truth that organizations across all sectors are confronting: digital infrastructure is now synonymous with operational infrastructure. When the network goes down, communications halt, revenue flows pause, and the organization’s ability to function can be compromised as severely as it would be by a physical disaster. For Lafayette’s leaders, the immediate challenge was to restore order and clarity in an environment dominated by ambiguity.

An Unfolding Crisis Demanding Coordinated Leadership

City executives quickly assembled a cross-functional incident response team. IT professionals worked to isolate infected systems and set up an entirely new email system, while department heads assessed operational impacts and developed temporary workarounds. 

Communications leaders drafted messaging to employees and the public, and the emergency manager coordinated with state and federal partners who could support the technical and investigative response.

The early hours of any cyber incident are often marked by limited information—something that can be especially challenging for leaders accustomed to making data-informed decisions. In this case, the cause of the intrusion was not immediately clear. Investigators suspected either a phishing email or brute-force attack, but full confirmation would take time. With systems encrypted and limited visibility into the extent of the breach, executives were forced to make urgent decisions based on partial information.

This scenario is increasingly common across the public and private sectors. Leaders are learning that modern crises—especially cyber incidents—do not wait for complete clarity. They demand action even as understanding evolves.

The Ransom Decision: A Leadership Crossroads

Perhaps the most consequential decision facing Lafayette’s leadership was whether to pay the ransom demanded by the attackers. Rebuilding systems from scratch was technically possible, but the process could take several months or years in some cases. 

During that time, residents would be without access to vital online services—including payments, building permits, communication channels, and recreation systems. At the height of the pandemic, when digital services were already under strain, such an interruption risked significant disruption to community life.

Paying a ransom is never an easy choice, nor one that leaders take lightly. It comes with ethical, legal, and practical implications. But it is also a decision many organizations—public and private—have faced as ransomware attacks have grown more sophisticated.

After weighing the options, Lafayette leadership authorized a $45,000 Bitcoin payment to the attackers in exchange for decryption keys. The decision was guided by several factors: the need to restore critical services quickly, the logistical and financial burden of rebuilding the entire system manually, and the importance of minimizing prolonged disruption to the community.

For leadership audiences, this moment reflects a broader theme: sometimes the “right” decision in a crisis is not the ideal one, but the one that best manages risk, continuity, and public welfare under imperfect conditions.

Transparency, Trust, and the Public’s Right to Know

In the days that followed, Lafayette adopted a transparent approach to public communication. City leaders informed residents about the attack, outlined which systems were affected, and offered guidance on how individuals could protect themselves if personal information had potentially been exposed.

This transparency—though challenging to deliver—reinforced public trust and set a tone of accountability. Leadership experts often point to trust as a renewable resource, one that can be strengthened or diminished in times of crisis.

Lafayette’s approach provided a model for how public institutions can communicate difficult news without eroding confidence. Transparency also helped redirect public conversation toward solutions and long-term improvements rather than speculation or frustration.

Strengthening the Organizational Core

Once core systems were restored, Lafayette began the work of fortifying its defenses to prevent future incidents. Leadership prioritized investments in:

• Secure, isolated data backups to reduce dependence on decryption keys in future incidents.
• Updated cybersecurity tools capable of detecting modern threats.
• Staff training designed to reduce human-factor vulnerabilities such as phishing.
• Comprehensive incident response planning and simulations.
• Deeper collaboration with cybersecurity agencies at the state and federal levels.

These actions reflect a key lesson for leaders: resilience is not built in the midst of crisis—it is built between crises. But crises often create the momentum needed to catalyze systemic  improvements.

Lessons for Today’s Leaders

The 2020 Lafayette attack has become a case study in executive leadership under digital threat. Several lessons stand out for leaders across sectors: 

1. Cyber readiness must be a strategic priority. It is no longer solely the domain of IT. Executive teams must understand and champion cybersecurity as part of organizational risk management.

2. Rapid decision-making is essential—even when information is incomplete. Cyber incidents evolve quickly, and delays can worsen the outcome. Leaders must be prepared to act decisively and adjust course as information is available.

3. Communication builds resilience. Transparent messaging during and after an incident strengthens community and organizational trust.

4. The human element matters. Staff training and organizational culture are often just as important to managing risk as firewalls and software.

5. Collaboration is critical. No organization—especially in the public sector—can navigate a major cyber incident alone. Partnerships with state, federal, and industry experts are essential.

6. Investing in resilience pays dividends. While cybersecurity improvements require budget and commitment, the cost of inaction can be far greater. 

The ransomware attack on Lafayette was not simply a cybersecurity event—it was a leadership defining moment. The city’s response demonstrated the importance of agility, transparency, and strategic thinking when navigating Twenty-first–century threats. 

As cyber risks continue to evolve, leaders at all levels are increasingly recognizing that protecting digital infrastructure is central to protecting
communities themselves.

For Lafayette, the lessons learned in 2020 continue to inform its approach to governance and resilience. And for leaders everywhere, the story serves as a reminder that the most significant threats may be the ones we cannot see—but must still be prepared to face.

KADY DOELLING is city manager for Lafayette, Colorado.
ERNESTO CHAVEZ is chief information officer for Lafayette, Colorado.