Loading story…
A ransomware attack targeted the OnSolve CodeRED emergency alert platform, operated by Crisis24, causing widespread outages for emergency notification services across numerous U.S. municipalities. The attack disrupted the ability of state, local, police, and fire agencies to send critical alerts, forcing affected regions to resort to alternative communication methods such as social media and door-to-door notifications. Municipalities including those in Colorado, Texas, Missouri, and many other states issued advisories to residents, warning of the service disruption and recommending immediate password changes for CodeRED accounts. Some municipalities, like Douglas County, Colorado, terminated their contracts with Crisis24, while others are awaiting the rollout of a new, more secure platform that Crisis24 claims is hosted in a separate, uncompromised environment.
The attackers stole user data from the CodeRED system, including names, addresses, email addresses, phone numbers, and account passwords. Crisis24 confirmed that the stolen data was published online and emphasized that no financial information was compromised, as CodeRED does not collect such data. Forensic analysis indicated the breach was contained to the CodeRED environment, with no impact on other Crisis24 systems. Municipalities and law enforcement agencies across multiple states have notified residents and advised them to change any reused passwords. Crisis24 is working to bring a new version of the emergency alert platform online, following a comprehensive security audit and additional hardening measures.
See attribution, scope, and your downstream exposure.
8 events from the most recent confirmed update back to the earliest known activity.
In the wake of the disruption and data breach, some jurisdictions, including Douglas County, Colorado, moved to terminate their CodeRED contracts and seek replacement emergency notification services. The incident prompted broader reassessment of reliance on the platform for public-safety communications.
INC Ransom publicly claimed responsibility by posting OnSolve on its leak site, sharing alleged data samples and negotiation details, and threatening to sell the stolen database if no ransom was paid. Reports said the leaked information included personally identifiable information and, in some cases, screenshots suggesting clear-text passwords.
Affected local governments, including University Park, Texas, and Cambridge, issued advisories saying CodeRED user data may have been exposed, including names, addresses, email addresses, phone numbers, and passwords. They emphasized that municipal internal systems were not impacted and urged residents to change reused passwords.
Crisis24 told customers the incident was contained to the CodeRED environment and did not affect other customer systems or the government-run Emergency Alert System. It notified law enforcement, launched a forensic investigation, and engaged external experts for security audits, penetration testing, and hardening of the replacement platform.
After determining the CodeRED environment had been damaged, Crisis24 permanently shut down or decommissioned the affected legacy platform. The company began accelerating migration to a new 'CodeRED by Crisis24' platform in a separate, non-compromised environment.
Following the ransomware attack, Crisis24's OnSolve CodeRED platform went offline or became unreliable for about two weeks, disrupting emergency notifications for towns, cities, law enforcement, and public safety agencies across the United States. Some jurisdictions resorted to social media, alternative systems, or door-to-door notifications.
INC Ransom said it encrypted files in the CodeRED environment on November 10, 2025. The attack damaged the legacy platform and contributed to a prolonged outage affecting municipal emergency notification services.
The INC ransomware group alleged it first gained access to the OnSolve CodeRED environment on November 1, 2025. This date was cited across reports as the start of the intrusion that later disrupted the emergency alert platform.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcego.theregister.com
Open sourcesecurityaffairs.com
Open sourcetherecord.media
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The OnSolve CodeRED emergency alert platform, widely used by city, county, and state government agencies for issuing critical notifications, was shut down following a ransomware attack attributed to the Inc ransomware gang. The attackers reportedly gained access to the CodeRED environment on November 1, 2025, and encrypted platform files on November 10, leading to a full suspension of the service. Crisis24, the platform's operator, confirmed that the breach was contained to the CodeRED environment and that all customers were transitioned to a new version of the platform. The ransomware group also claimed to have stolen sensitive subscriber data and rejected a $100,000 ransom offer from Crisis24 during negotiations. The incident caused significant disruption to emergency notification capabilities during the Thanksgiving holiday period, raising concerns about the resilience of critical public safety infrastructure. The breach and subsequent outage were widely reported in security news roundups, with additional coverage highlighting the risks to millions of users and the broader impact on government agencies' ability to communicate during emergencies. Authorities, including the French National Cybersecurity Agency (ANSSI) and the French Data Protection Authority (CNIL), were notified, and the incident has prompted renewed scrutiny of cybersecurity practices in essential service platforms.
Jun 29, 2026
The City of Coweta, Oklahoma said a ransomware attack caused a system-wide outage across city computers, files, and computer-based services, disrupting municipal operations while leaving the city website and a third-party online billing portal accessible. Officials said the intrusion affected city systems broadly, prompting an immediate response with the city's contracted IT provider and additional cybersecurity professionals to secure the environment, contain further intrusion, and begin recovery efforts. City officials said the Coweta Police Department and Fire Department were not affected because they operate through off-site systems, and emergency services including **911** remained operational throughout the incident. The city also said it has an **offsite backup** and plans to use it to restore data once systems are cleared and deemed safe for recovery.
Aug 10, 2026
Rome’s **La Sapienza University** shut down network systems as a precaution after a cyberattack caused widespread disruption and left its website offline; Italian media attributed the incident to a suspected ransomware operation linked to pro-Russian actor **Femwar02**, with reported tradecraft resembling **Bablock/Rorschach**-style fast encryption. Separately, Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT and took down `www.conpet.ro` while leaving **OT/SCADA** and pipeline transport operations unaffected; **Qilin** claimed responsibility, alleging theft of nearly **1TB** of data and posting sample documents (including financial data and passport scans) to support extortion claims. In the U.S., government services contractor **Conduent** faced expanding breach impact from its January 2025 ransomware incident, with notifications indicating exposure potentially reaching **dozens of millions**; reported affected data includes **names, Social Security numbers, and medical/health insurance information**, with at least **15.4M** impacted in Texas and **10.5M** in Oregon per state disclosures. Additional healthcare-sector disclosures included a ransomware-linked intrusion at **Insightin Health** (unauthorized access in September 2025; **Medusa** claimed exfiltration of **378GB**) and a separate compromise at **Clinic Service Corporation** (August 2025 access window), while **Central Ozarks Medical Center** reported a criminal cyberattack affecting **11,818** individuals with exposure of PHI/PII (including SSNs and financial/insurance data). Other items in the set were not incident-specific: an **HHS-OIG** audit describing web application security weaknesses at a large hospital, and general guidance/education pieces on the value of medical records to attackers and **CISA** insider-threat guidance.
Jun 29, 2026