On October 13 and October 15, 2026, Colorado County Judge Ty Prause posted emergency meetings of the Commissioners Court under Texas Government Code §551.045. Both notices say the county is responding to a disruption of county information systems that presents an imminent threat to public health and safety, including systems that support public-safety operations. The meetings were at the courthouse in Columbus: Courtroom 106, 400 Spring Street.
The notices name the disruption. They leave the cause, any copied records, and any vote unnamed.
Snapshot
| Field | Detail |
|---|---|
| Meetings | Oct 13, 2026, 11:00 a.m. · Oct 15, 2026, 10:00 a.m. |
| Body | Colorado County Commissioners Court |
| Place | Courtroom 106, 400 Spring Street, Columbus, Texas 78934 |
| What the notices say | Disruption of information systems; threat to public health and safety and to public-safety operations |
| Judge on the notices | Ty Prause · (979) 732-2604 |
| Outside name | A NightSpire listing for “Colorado Texas” on Oct 14. The county has not adopted that name |
The October 13 notice and the October 15 notice use the same emergency statement. Each meeting was posted at least one hour ahead, which is the short-notice rule in §551.045. Columbus, the county seat, describes itself on the chamber site as about 70 miles west of Houston. The emergency items are the county court, not a chamber agenda.
DysruptionHub (Joseph Topping, October 19) wrote that officials had not confirmed a cyberattack. It also wrote that a leak-site tracker listed “Colorado Texas” on October 14 UTC with no victim website, and that the connection to this county was unconfirmed. The county had not answered a comment request, and the October 15 notice was still the latest public county update as of that article. BeyondMachines on October 20 likewise said the county had not confirmed ransomware or that information was taken.
DeXpose on October 15 wrote that NightSpire targeted co.colorado.tx.us and quoted a listing line, “Data is not available now.” That page is the outlet’s reading of a listing. It is not a finding from the Commissioners Court. This post does not link the listing.
On October 24, the county homepage still led with a burn-ban note and a September 8 tax-rate notice. The minutes index we reviewed did not include a minute file for October 13 or October 15. The Colorado County Citizen homepage that day led with early voting, a cook-off, and other local items. Those headlines did not mention the disruption.
What the agendas put in front of the court
| Topic | What the notice says |
|---|---|
| Restoration | Status of the response and continuity of essential services, including public-safety operations |
| Impact | Scope and operational impact |
| Protection | Security measures for county information-resources technology |
| Legal | Legal, regulatory, and notification obligations |
| Spending | Professional help and related expenditures |
The court may close the session for three topics printed on both notices. No final vote is taken in the closed session.
| Closed-session topic | Statute on the notice |
|---|---|
| Conference with the court’s attorney | Tex. Gov’t Code §551.071 |
| Security of information resources | Tex. Gov’t Code §551.089 |
| Protection of critical infrastructure | Tex. Gov’t Code §551.0761 |
What a reader can do with this
| Do | Why |
|---|---|
| Read the two county PDFs | They are the county’s public description of the disruption |
| Keep the NightSpire name in the “listing” column | DysruptionHub said the county had not confirmed a cyberattack |
| Type co.colorado.tx.us | A mail about a “county login restore” is not in these notices |
| Call (979) 732-2604 only if you already use that county number | That is the phone printed on Judge Prause’s notices |
A hardware key on a personal mailbox does not restore county systems, and it does not tell a resident whether a record was copied. The notices do not describe how the disruption started.
MFA on the public county site and on CIRA email
| Grade | Meaning |
|---|---|
| Fail | SMS, email, or a phone call is still a documented sign-in, or no public key / authenticator path is published |
| Strong | FIDO2 / YubiKey-class security key for sign-in |
| Platform | Grade | YubiKey | Authenticator |
|---|---|---|---|
| Colorado County public site | Fail | No | No |
| TAC CIRA email | Fail | No | No |
We did not find a resident or employee login on the public county site that names YubiKey or Google Authenticator. That gap is Fail. The site itself is on Wix. Court minutes sit on a County Information Resources Agency host. Those facts do not say the county’s mailboxes are a CIRA product.
TAC CIRA’s email MFA setup offers three choices for counties that buy CIRA email: a text message, the Microsoft Authenticator app, or a phone call. It does not name YubiKey or Google Authenticator. Text and a phone call remain, so the product grade is Fail. We did not find a Colorado County page that says this county’s mail uses that product. A key on a personal account is a different login.
Directory: MFA support directory · Business Apps.
Recommended MFA tools
| Product | Best for | Get it |
|---|---|---|
| YubiKey 5C NFC | USB-C laptops + NFC phones | Amazon |
| YubiKey 5 NFC | USB-A desktops + NFC phones | Amazon |
| Proton Pass | Passkeys + authenticator-style TOTP | Proton Pass |
We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.
Independent cybersecurity audits
We audited the county, the association that hosts the minutes, the Columbus chamber, the two outlets, and the local paper on October 24, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not measure whether county systems are restored.
| Organization | Domain | Overall | vs 100% |
|---|---|---|---|
| TAC CIRA | cira.state.tx.us | 69% | −31 |
| Columbus TX Chamber | columbustexas.org | 68% | −32 |
| Colorado County | co.colorado.tx.us | 68% | −32 |
| DysruptionHub | dysruptionhub.com | 58% | −42 |
| Colorado County Citizen | coloradocountycitizen.com | 56% | −44 |
| DeXpose | dexpose.io | 52% | −48 |
| Domain | Identity | Transport | Website |
|---|---|---|---|
| cira.state.tx.us | 90% | 15% | 40% |
| columbustexas.org | 90% | 15% | 39% |
| co.colorado.tx.us | 50% | 15% | 90% |
| dysruptionhub.com | 65% | 15% | 37% |
| coloradocountycitizen.com | 60% | 15% | 37% |
| dexpose.io | 50% | 15% | 37% |
Audit links: cira.state.tx.us · columbustexas.org · co.colorado.tx.us · dysruptionhub.com · coloradocountycitizen.com · dexpose.io
co.colorado.tx.us is 68% overall, with Website 90% and Identity 50%. Transport is 15% on every host in this set. Type the real county host if a mail offers a restoration portal.
Website stack
Passive homepage + Certificate Transparency probes (October 24, 2026). Versions only — not a claim these homepages were the disrupted systems.
| Domain | Stack note |
|---|---|
| co.colorado.tx.us | Wix (vendor-managed); Let’s Encrypt TLS expires 2027-01-03 |
| dysruptionhub.com | Ghost 6.72; Express header; Let’s Encrypt TLS expires 2027-01-18 |
| cira.state.tx.us | CMS undetected; certificate date not returned |
| dexpose.io | WordPress, version hidden; Google Trust TLS expires 2027-01-14 |
| columbustexas.org | WordPress, version hidden; GoDaddy TLS expires 2027-03-14 |
| coloradocountycitizen.com | CMS undetected; Google Trust TLS expires 2026-12-15 |
Blacklist and lookalikes
Email blacklist checks (public DoH, October 24, 2026): co.colorado.tx.us, cira.state.tx.us, columbustexas.org, dysruptionhub.com, coloradocountycitizen.com, and dexpose.io were clear on mail/domain lists we can query. columbustexas.org, coloradocountycitizen.com, and dexpose.io showed SPFBL on web IPs — shared-edge noise, not led.
The county-domain and CIRA-domain scans mostly returned short tx labels (ntx.us, tx.net, and similar). Those are suffix collisions, not county-name impostors. DysruptionHub and the Citizen had no threatening registered lookalike in this pass. dexpose.com and dexpose.xyz are registered and did not show mail.
| Lookalike | Technique | Signal |
|---|---|---|
| columbustexas.net | TLD swap | Mail (NS + A + MX) |
columbustexas.com is registered with a site and did not show mail in this scan. The .net host can receive mail under the Columbus name. The emergency notices are the county, at co.colorado.tx.us. Continuous monitoring: Cybersquat Domain Monitoring.
CourtListener searches on October 24, 2026 returned no federal docket filed since October 1, 2026 for “Colorado County,” and no docket for NightSpire. An older Southern District of Texas case, Ortiz (4:16-cv-03708), was remanded to a Colorado County state court in 2016. That remand is a different matter.
Related coverage
Sources: Oct 13 emergency notice · Oct 15 emergency notice · DysruptionHub, Oct 19, 2026 · DeXpose, Oct 15, 2026 · BeyondMachines, Oct 20, 2026 · TAC CIRA MFA setup. Independent EmailMeNow audits, website-tech, blacklist, cybersquat, and CourtListener searches October 24, 2026. Domain scores: audit.emailmenow.com only.