York never publicly disclosed a 2025 ransomware attack that hit email and parking systems and ended in a $500,000 insurance payout.