City of Sheboygan

The City of Sheboygan, Wisconsin, suffered a ransomware attack on October 31, 2024, executed by the Chort ransomware gang. The breach exposed personal information of 67,000 individuals, including Social Security numbers, state IDs, and license plate numbers, which were confirmed stolen after a cybersecurity investigation concluded on May 14, 2025. Initially, the city denied evidence of data theft, but later filed breach notification letters with regulators, acknowledging the compromise. The attack disrupted municipal operations, though emergency services remained functional. The city reported the incident to law enforcement and followed their guidance, offering one year of identity protection services to affected individuals. The Chort gang had previously claimed responsibility in November 2024, sharing screenshots of stolen file archives and demanding a ransom. Sheboygan is among multiple Wisconsin government entities targeted by ransomware in recent years, alongside other victims like Hartwick College (New York) and Kuwait’s Public Authority of Agriculture Affairs and Fish Resources.

Source: https://therecord.media/ransomware-sheboygan-breach-notice

TPRM report: https://www.rankiteo.com/company/city-of-sheboygan

"id": "cit4885148112725",
"linkid": "city-of-sheboygan",
"type": "Ransomware",
"date": "10/2024",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'customers_affected': '67,000 individuals',
                        'industry': 'public administration',
                        'location': 'Sheboygan, Wisconsin, USA',
                        'name': 'City of Sheboygan',
                        'size': '~50,000 residents',
                        'type': 'municipal government'}],
 'customer_advisories': 'identity protection services (1 year) offered to '
                        'victims',
 'data_breach': {'data_exfiltration': True,
                 'file_types_exposed': 'archives (screenshots shared by '
                                       'attackers)',
                 'number_of_records_exposed': '67,000',
                 'personally_identifiable_information': True,
                 'sensitivity_of_data': 'high (includes SSNs)',
                 'type_of_data_compromised': ['personally identifiable '
                                              'information (PII)',
                                              'government-issued identifiers']},
 'date_detected': '2024-10-31',
 'date_publicly_disclosed': '2024-11-01',
 'description': 'The Wisconsin city of Sheboygan warned about 67,000 people '
                'that a ransomware attack in October 2024 gave hackers access '
                'to their personal information, including Social Security '
                'numbers, state IDs, and license plate numbers. The attack was '
                'claimed by the Chort ransomware gang, which demanded a ransom '
                'and shared screenshots of stolen file archives. The city '
                'conducted an investigation with a cybersecurity firm, '
                'confirmed data theft, and is providing identity protection '
                'services to affected individuals.',
 'impact': {'brand_reputation_impact': 'potential reputational damage due to '
                                       'breach of 67,000 records',
            'data_compromised': ['Social Security numbers',
                                 'state IDs',
                                 'license plate numbers',
                                 'file archives (screenshots shared by '
                                 'attackers)'],
            'identity_theft_risk': 'high (PII including SSNs exposed)',
            'operational_impact': 'emergency services remained available; no '
                                  'further updates after 2024-11-22',
            'systems_affected': 'city systems (unspecified)'},
 'investigation_status': 'completed (concluded on 2025-05-14)',
 'motivation': 'financial (ransom demand)',
 'ransomware': {'data_exfiltration': True,
                'ransom_demanded': True,
                'ransomware_strain': 'Chort'},
 'references': [{'source': 'City of Sheboygan breach notification letters'},
                {'source': 'News report on Chort ransomware gang activities'}],
 'regulatory_compliance': {'regulatory_notifications': 'breach notification '
                                                       'letters filed with '
                                                       'regulators'},
 'response': {'communication_strategy': 'breach notification letters filed '
                                        'with regulators; public disclosure; '
                                        'identity protection services offered '
                                        '(1 year)',
              'incident_response_plan_activated': True,
              'law_enforcement_notified': True,
              'third_party_assistance': 'cybersecurity firm (unspecified)'},
 'stakeholder_advisories': 'breach notification letters sent to 67,000 '
                           'affected individuals',
 'threat_actor': 'Chort ransomware gang',
 'title': 'Ransomware Attack on the City of Sheboygan, Wisconsin',
 'type': 'ransomware attack'}