Loading story…
Dallas County, Iowa agreed to pay $600,000 to two penetration testers, Gary DeMercurio and Justin Wynn, who were arrested in 2019 while conducting an authorized physical security test of the Dallas County Courthouse for Iowa’s Judicial Branch. The testers—then employees of Coalfire Labs (and later leaders at Kaiju Security)—were jailed for roughly 20 hours and charged with burglary-related offenses after intentionally triggering the courthouse alarm as part of the contracted assessment, despite having prior authorization for the engagement.
The criminal case became a prolonged legal ordeal; charges were later dropped, and the testers filed a civil lawsuit in 2021 that settled on Jan. 23 shortly before trial. Reporting notes the incident as a cautionary example of the legal and operational risk to security professionals conducting red-team/physical intrusion work, and highlights how misalignment between contracting authorities and local law enforcement can escalate authorized testing into arrests, reputational harm, and career impact even when the work is sanctioned.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
On January 23, 2026, shortly before the civil trial was set to begin, Dallas County agreed to pay $600,000 to settle the lawsuit brought by the two former Coalfire testers. The settlement resolved claims stemming from their 2019 arrest during the authorized courthouse test.
In 2021, DeMercurio and Wynn filed a civil lawsuit seeking damages related to their arrest, jailing, and resulting professional and reputational harm. The suit extended the dispute into a multi-year legal conflict involving county and state entities.
The burglary-related charges filed against the two security researchers were later dismissed. The case nevertheless drew scrutiny over how the authorized test had been handled and the legal risks faced by security researchers.
After the alarm response, Dallas County law enforcement arrested DeMercurio and Wynn despite their documentation showing they were conducting an authorized test. They were jailed for about 20 hours and charged with burglary and possession of burglary tools.
In 2019, Coalfire Labs employees Gary DeMercurio and Justin Wynn carried out an authorized physical security assessment at the Dallas County Courthouse under a contract with Iowa's Judicial Branch. As part of the test, they entered the courthouse and intentionally triggered the alarm to evaluate response procedures.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Former Saydel Community School District IT employee **Ezekiel Dean Potter** was sentenced to **21 months in prison** after prosecutors said he carried out a prolonged cyber sabotage campaign against the Iowa district following his April 2023 termination. Authorities said Potter kept access to more than 300 district credentials and, from May 2023 through January 2025, used them to delete accounts, take down the district’s Facebook page, interfere with **Apple School Manager**, target **GoDaddy**, and compromise **Google/Gmail**, **PowerSchool Schoology**, and other school services. The intrusions locked teachers out of platforms, disrupted classrooms, and caused tens of thousands of dollars in losses, with reported direct costs exceeding **$73,000** and restitution set at **$59,668.81**. Investigators tied the activity to Potter through forensic evidence including IP addresses linked to later employers, activity traced despite VPN use, and a USB drive containing spreadsheets of district usernames and passwords. Potter pleaded guilty in January 2026 to computer fraud charges under the **Computer Fraud and Abuse Act** and was also ordered to serve supervised release with computer-use monitoring conditions.
Jun 29, 2026
Dutch police arrested a **40-year-old man from Ridderkerk** after he obtained **confidential police documents** due to a police error and then allegedly attempted to leverage possession of the files for something in return. According to police, the man was taken into custody on Thursday evening, his home was searched, and data storage devices were seized to recover the documents and prevent further dissemination; authorities also reported the incident as a **data breach** and said the investigation is ongoing. Reporting indicates the incident began when the man contacted police in connection with a separate matter and was sent a link intended for **uploading** images; instead, an officer mistakenly sent a **download link**, granting access to sensitive materials the recipient was not meant to see. While the man reportedly did not exploit a technical vulnerability or “break in” in a traditional sense, police said he was instructed to stop and delete the material and refused unless he “received something in return,” prompting the arrest and evidence seizure to contain the exposure.
Jun 29, 2026