City of Sheboygan

The City of Sheboygan in Wisconsin fell victim to a ransomware attack in late October, orchestrated by the Chort ransomware operation. The breach resulted in the theft of sensitive personal data belonging to nearly 67,000 individuals, including Social Security numbers, state IDs, and license plate numbers. Initially, officials downplayed the likelihood of data compromise, but subsequent investigations confirmed the exfiltration of personally identifiable information (PII). While the attack did not disrupt emergency services, the exposure of such critical data poses significant risks of identity theft and fraud. Affected individuals are being offered one year of complimentary identity protection services as a remedial measure. The Chort group has been linked to similar attacks on other institutions, including educational and government entities in New York, Georgia, and Kuwait.

Source: https://www.scworld.com/brief/ransomware-attack-against-wisconsin-city-hits-almost-67k

TPRM report: https://www.rankiteo.com/company/city-of-sheboygan

"id": "cit0431104112825",
"linkid": "city-of-sheboygan",
"type": "Ransomware",
"date": "5/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'customers_affected': '67,000 individuals',
                        'industry': 'Public Administration',
                        'location': 'Sheboygan, Wisconsin, USA',
                        'name': 'City of Sheboygan',
                        'type': 'Government (Municipality)'}],
 'customer_advisories': 'Breach notification letters with offer of 1 year of '
                        'identity protection services',
 'data_breach': {'data_exfiltration': True,
                 'number_of_records_exposed': '67,000',
                 'personally_identifiable_information': ['Social Security '
                                                         'numbers',
                                                         'state IDs',
                                                         'license plate '
                                                         'numbers'],
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Personally Identifiable '
                                              'Information (PII)']},
 'date_detected': '2023-10-31',
 'description': "Officials at Wisconsin's City of Sheboygan reported that "
                'information from almost 67,000 individuals was stolen '
                'following a ransomware attack in October, claimed by the '
                'Chort ransomware operation. The infiltration on Oct. 31 '
                'enabled the theft of Social Security numbers, state IDs, and '
                'license plate numbers. Emergency services were not disrupted. '
                'Affected individuals will receive a year of complimentary '
                'identity protection services.',
 'impact': {'data_compromised': ['Social Security numbers',
                                 'state IDs',
                                 'license plate numbers'],
            'identity_theft_risk': 'High (PII exposed)',
            'operational_impact': 'No disruption to emergency services'},
 'ransomware': {'data_exfiltration': True, 'ransomware_strain': 'Chort'},
 'references': [{'source': 'The Record (by Recorded Future)'}],
 'response': {'communication_strategy': 'Breach notification letters sent to '
                                        'affected individuals',
              'recovery_measures': 'Offered 1 year of complimentary identity '
                                   'protection services to affected '
                                   'individuals'},
 'threat_actor': 'Chort ransomware gang',
 'title': 'Ransomware Attack on City of Sheboygan, Wisconsin',
 'type': ['ransomware', 'data breach']}