Loading story…
Union County, Ohio, experienced a significant ransomware attack in May 2025 that resulted in the compromise of sensitive personal data belonging to 45,487 individuals, including both residents and county employees. The attack was detected on May 18, 2025, after cybercriminals had maintained unauthorized access to the county’s network from May 6 to May 18. During this period, the attackers exfiltrated a wide range of sensitive information, such as names, Social Security numbers, financial account details, driver’s license numbers, medical information, fingerprint data, and passport numbers. Upon discovery of the ransomware, Union County officials immediately launched an investigation, enlisting the help of nationally recognized third-party cybersecurity and data forensics consultants to secure their network and determine the scope of the breach. Federal law enforcement agencies were also notified as part of the county’s incident response. By August 25, 2025, the county had completed its review of the breach and began sending notification letters to all affected individuals, outlining the types of data compromised and the steps being taken in response. As of late September 2025, no known ransomware group had claimed responsibility for the attack, and the specific threat actor remains unidentified. The breach notification letters emphasized the breadth of the data stolen, highlighting the potential risks for identity theft and financial fraud among those affected. Union County, with a population of over 75,000 and recognized as one of Ohio’s fastest-growing regions, faced significant operational and reputational challenges as a result of the incident. The attack on Union County is part of a broader trend of ransomware campaigns targeting state, county, and city governments across the United States in 2025. Other recent incidents have included attacks on North Carolina’s Waxhaw town, where the Qilin ransomware gang exfiltrated over 600 GB of data, as well as separate breaches affecting Ohio’s Lorain County and the Maryland state government. The Union County incident underscores the persistent threat posed by ransomware actors to local government entities and the critical importance of robust cybersecurity measures, timely incident response, and transparent communication with affected stakeholders. The county’s response included not only technical remediation but also public disclosure and cooperation with law enforcement, reflecting best practices in breach management. The full impact of the breach, including any potential misuse of the stolen data, remains to be seen as investigations continue. Union County’s experience serves as a cautionary example for other local governments regarding the risks of ransomware and the need for comprehensive data protection strategies.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Union County, Ohio reported a ransomware attack that impacted more than 45,000 individuals. The incident was publicly disclosed in late September 2025 and described as affecting county systems and residents' data.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rome’s **La Sapienza University** shut down network systems as a precaution after a cyberattack caused widespread disruption and left its website offline; Italian media attributed the incident to a suspected ransomware operation linked to pro-Russian actor **Femwar02**, with reported tradecraft resembling **Bablock/Rorschach**-style fast encryption. Separately, Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT and took down `www.conpet.ro` while leaving **OT/SCADA** and pipeline transport operations unaffected; **Qilin** claimed responsibility, alleging theft of nearly **1TB** of data and posting sample documents (including financial data and passport scans) to support extortion claims. In the U.S., government services contractor **Conduent** faced expanding breach impact from its January 2025 ransomware incident, with notifications indicating exposure potentially reaching **dozens of millions**; reported affected data includes **names, Social Security numbers, and medical/health insurance information**, with at least **15.4M** impacted in Texas and **10.5M** in Oregon per state disclosures. Additional healthcare-sector disclosures included a ransomware-linked intrusion at **Insightin Health** (unauthorized access in September 2025; **Medusa** claimed exfiltration of **378GB**) and a separate compromise at **Clinic Service Corporation** (August 2025 access window), while **Central Ozarks Medical Center** reported a criminal cyberattack affecting **11,818** individuals with exposure of PHI/PII (including SSNs and financial/insurance data). Other items in the set were not incident-specific: an **HHS-OIG** audit describing web application security weaknesses at a large hospital, and general guidance/education pieces on the value of medical records to attackers and **CISA** insider-threat guidance.
Jun 29, 2026
A ransomware attack on the Nevada state government was enabled by a state employee's accidental download of a trojanized system administration tool from a fraudulent website in May. The attackers established a backdoor, conducted lateral movement, and infiltrated the state's password vault server over several months. By August, they had exfiltrated sensitive data, deleted backup volumes, and deployed ransomware, disrupting services at more than 60 state agencies, including health benefits, public safety records, and DMV operations. The incident forced critical systems offline for up to 28 days, with recovery efforts requiring a full rebuild of Active Directory and significant overtime from IT staff. The state did not pay a ransom, and most recovery costs were covered by cyberinsurance, totaling at least $1.5 million. The after-action report from Nevada's technology office highlighted the attacker's use of search ads to distribute malware disguised as legitimate admin tools, a growing trend in initial access techniques. Despite the extensive impact, Nevada was commended for its accelerated response and transparency in reporting, restoring 90% of impacted data within a month. The incident underscores the risks of supply chain and user-driven compromises, as well as the importance of robust detection, backup, and identity management practices in defending against sophisticated ransomware campaigns targeting government infrastructure.
Jun 29, 2026
Winona County, Minnesota, detected ransomware on its IT network on January 22, 2026, engaged third-party forensic specialists, notified federal law enforcement, and negotiated with the attackers. With support from its cyber insurer, the county paid **$128,539.57** in ransom; it sent written notifications to affected individuals and made public disclosures on May 12. The county subsequently detected a second, apparently unrelated ransomware incident in April. That intrusion remained under investigation, underscoring that the county experienced two distinct ransomware attacks against its environment in 2026.
Sep 1, 2026