Loading story…
The Anchorage Police Department (APD) took multiple containment steps after being notified of a security incident affecting its third-party technology service provider, Whitebox Technologies, a data migration firm. After Whitebox alerted APD to the incident on January 7, the city’s IT department shut down relevant APD servers and disabled the vendor and all third-party service provider access as a precaution while the investigation proceeds.
APD stated there was no evidence its internal systems were compromised or that APD data was acquired by the threat actor, but it is continuing heightened monitoring for unusual activity and implementing additional protective measures. Officials also reported overseeing the deletion and removal of remaining APD data from the provider’s servers and said they would notify potentially impacted individuals if warranted; as of reporting, no ransomware group had claimed responsibility and Whitebox had not publicly commented despite requests for information.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
APD publicly stated that it had found no evidence its own systems were compromised or that APD data was acquired by the threat actor, while continuing monitoring and protective measures as the provider-led investigation proceeded.
After the notification, the City of Anchorage IT department shut down relevant APD servers, disabled vendor and other third-party access, and oversaw deletion or removal of remaining APD data from Whitebox's servers as containment measures.
Data migration firm Whitebox Technologies alerted the Anchorage Police Department on January 7 that it had experienced a security incident affecting one of APD's technology service providers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The City of Coweta, Oklahoma said a ransomware attack caused a system-wide outage across city computers, files, and computer-based services, disrupting municipal operations while leaving the city website and a third-party online billing portal accessible. Officials said the intrusion affected city systems broadly, prompting an immediate response with the city's contracted IT provider and additional cybersecurity professionals to secure the environment, contain further intrusion, and begin recovery efforts. City officials said the Coweta Police Department and Fire Department were not affected because they operate through off-site systems, and emergency services including **911** remained operational throughout the incident. The city also said it has an **offsite backup** and plans to use it to restore data once systems are cleared and deemed safe for recovery.
Aug 10, 2026
Dyfed-Powys Police in Wales disclosed a cyberattack that disrupted several non-emergency systems, including online and email contact services. The force identified the incident on September 14 and later restored the affected services, while maintaining emergency response operations. The force said it has found no evidence that public personal data was accessed, but is investigating whether employee information was compromised. It notified the Information Commissioner's Office, engaged cybersecurity specialists, and implemented precautionary measures; Tarian, southern Wales's regional organized-crime unit, is leading the investigation. The intrusion vector, affected staff-data scope, and responsible threat actor remain unknown, with no public claim of responsibility.
Sep 28, 2026
Leduc County experienced a deliberate ransomware attack on December 25, which disabled several of the county’s information technology systems. The incident led to the proactive shutdown of additional IT services as a precaution during an ongoing forensic investigation. Key stakeholders, including the RCMP, insurance, and banking providers, were notified, and affected services included the county’s email platform, safety codes permits, development permits online portal, and website form submissions. Authorities responded quickly to the incident, with the RCMP receiving a report on Christmas Day. County officials stated that the attack was detected early, allowing for rapid engagement of cybersecurity experts and containment measures. Preliminary findings suggest minimal information was compromised, and the county is working to restore normal operations, though no timeline has been provided. Updates will be communicated to residents and stakeholders as the investigation progresses. No threat actor has claimed responsibility for the attack at this time.
Jul 12, 2026