Loading story…
The Pennsylvania Office of the Attorney General suffered a ransomware attack in August 2025, resulting in the theft of files containing personal and medical information, including Social Security numbers. The attack, claimed by the INC Ransom gang, disrupted the office’s operations by taking down its website, email, and phone systems, and forced staff to use alternative communication methods for nearly a month. The breach was discovered on August 9, and subsequent investigation confirmed that sensitive data was accessed and stolen, though officials have stated there is no evidence of misuse so far.
The ransomware group claimed to have stolen 5.7TB of data, and the office has notified affected individuals and the FBI. Security experts noted that the office had vulnerable Citrix NetScaler appliances exposed to the internet, which may have facilitated the breach. The incident caused significant disruption to Pennsylvania’s legal system, including delays in criminal and civil cases, but the office refused to pay the ransom demanded by the attackers.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
On 2025-11-17, Pennsylvania's Office of the Attorney General confirmed that the August ransomware incident involved unauthorized access and theft of files containing personal and medical information, including names and Social Security numbers. Officials said there was no evidence at the time that the stolen data had been misused.
On 2025-09-20, the INC Ransom group claimed responsibility for the attack, alleging it stole 5.7TB of data from the Pennsylvania OAG and asserting the compromise also provided access to an FBI internal network. Reporting also linked the incident to potentially exposed public-facing Citrix NetScaler appliances and possible exploitation of CVE-2025-5777, known as 'Citrix Bleed 2.'
In August 2025, the Pennsylvania Office of the Attorney General was hit by a ransomware attack that encrypted systems and caused widespread outages affecting its website, employee email, landline phones, and broader legal operations for nearly a month. Attorney General Dave Sunday later said the office refused to pay the ransom.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The INC Ransom ransomware group claimed responsibility for a cyberattack on the Pennsylvania Office of the Attorney General, alleging the theft of 5.7 TB of data. Data samples purportedly stolen from the office were posted on INC's leak site, though the state has not confirmed the extent of the breach and has refused to pay the ransom. This incident is notable as the largest reported data theft from a U.S. government entity in 2025, according to security researchers. The attack highlights the growing threat posed by the INC Ransom group, which has targeted multiple high-profile organizations in recent months.
Jun 29, 2026
**Greater Pittsburgh Orthopaedic Associates (GPOA)** reported an August 2025 security incident involving **unauthorized access to its IT network**, which it detected around **August 10, 2025**. GPOA told state regulators and affected individuals that a forensic investigation determined patient data *could have been compromised*, with potentially exposed elements including **name, mailing address, Social Security number, and provider name**; the organization said it engaged incident response support, notified law enforcement, and began security hardening and awareness efforts. Regulatory reporting and victim notification timelines and counts appear inconsistent across disclosures: GPOA reported the incident to **HHS** in late August 2025 as affecting roughly **35,000** individuals, while later filings to the **Maine Attorney General** indicated **56,954** impacted people, and individual notification letters were mailed in early February 2026. Separately, the **RansomHouse** leak site listed GPOA in August 2025 and claimed the victim was **encrypted**, posting a limited “proof pack,” but the listing was not updated and there was no clear confirmation from GPOA that ransomware encryption or data publication occurred.
Jun 29, 2026
A ransomware attack on the Nevada state government was enabled by a state employee's accidental download of a trojanized system administration tool from a fraudulent website in May. The attackers established a backdoor, conducted lateral movement, and infiltrated the state's password vault server over several months. By August, they had exfiltrated sensitive data, deleted backup volumes, and deployed ransomware, disrupting services at more than 60 state agencies, including health benefits, public safety records, and DMV operations. The incident forced critical systems offline for up to 28 days, with recovery efforts requiring a full rebuild of Active Directory and significant overtime from IT staff. The state did not pay a ransom, and most recovery costs were covered by cyberinsurance, totaling at least $1.5 million. The after-action report from Nevada's technology office highlighted the attacker's use of search ads to distribute malware disguised as legitimate admin tools, a growing trend in initial access techniques. Despite the extensive impact, Nevada was commended for its accelerated response and transparency in reporting, restoring 90% of impacted data within a month. The incident underscores the risks of supply chain and user-driven compromises, as well as the importance of robust detection, backup, and identity management practices in defending against sophisticated ransomware campaigns targeting government infrastructure.
Jun 29, 2026