SafePay Ransomware Group Claims Responsibility for April 2026 Attack on Harrison County, WV
On May 18, 2026, the ransomware group SafePay took credit for a cyberattack on the Harrison County Commission in West Virginia, which disrupted operations in April. The attack, first reported by the commission on April 23, forced the closure of county courthouse services the following day, preventing residents from paying property taxes. While most systems were restored within a week, some remained offline as of May 6.
SafePay, which operates a LockBit-based ransomware strain, issued a ransom demand via its data leak site, giving the commission three days to pay an undisclosed sum in exchange for stolen data. The group employs a double-extortion tactic, threatening both system encryption and data leaks. The Harrison County Commission has not confirmed SafePay’s claim, and key details including the breach method, number of affected individuals, and whether a ransom was paid remain unconfirmed.
As of May 6, the commission reported that public safety and election systems remained unaffected, though some administrative functions, particularly in the Sheriff’s Office, faced temporary disruptions.
About SafePay
Active since November 2024, SafePay has claimed 479 ransomware attacks, with 68 confirmed by targeted organizations. In 2026 alone, it has attributed 56 attacks, including six verified incidents. The group has increasingly targeted U.S. government entities, with 12 claimed breaches in the sector, alongside attacks on international organizations like Germany’s Abfallentsorgung Kreis Kassel in February 2026.
Broader Impact on U.S. Government Entities
The Harrison County incident is part of a rising trend of ransomware attacks on local governments. In 2026, 21 confirmed attacks on U.S. government bodies have been recorded, including:
- Winona County, MN (Interlock, January 2026, 6,196 affected)
- Suffolk, VA (Cloak, February 2026, 157,725 affected)
- MassDevelopment, MA (DragonForce, March 2026)
- Gainesville-Alachua County Regional Airport Authority, FL (Qilin, October 2025, 2,141 affected)
Such attacks can paralyze critical services, from billing to emergency response, while exposing sensitive data to fraud risks. Recovery often spans weeks or months, with long-term consequences for affected communities.
Harrison County Overview
Home to 65,000 residents, Harrison County is governed by a three-member commission responsible for infrastructure, public safety, and administrative functions. The county seat is Clarksburg, WV.
Harrison County Economic Development Corporation-WV cybersecurity rating report: https://www.rankiteo.com/company/harrisonedc
"id": "HAR1779208072",
"linkid": "harrisonedc",
"type": "Ransomware",
"date": "4/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Public Administration',
'location': 'Clarksburg, West Virginia, USA',
'name': 'Harrison County Commission',
'size': '65,000 residents (county population)',
'type': 'Government'}],
'data_breach': {'data_encryption': True,
'data_exfiltration': True,
'sensitivity_of_data': 'Potentially sensitive (unspecified)'},
'date_detected': '2026-04-23',
'date_publicly_disclosed': '2026-04-23',
'description': 'On May 18, 2026, the ransomware group SafePay claimed '
'responsibility for a cyberattack on the Harrison County '
'Commission in West Virginia, which disrupted operations in '
'April 2026. The attack forced the closure of county '
'courthouse services, preventing residents from paying '
'property taxes. Most systems were restored within a week, but '
'some remained offline as of May 6. SafePay issued a ransom '
'demand via its data leak site, employing a double-extortion '
'tactic.',
'impact': {'brand_reputation_impact': True,
'data_compromised': True,
'downtime': 'Some systems remained offline as of May 6, 2026',
'identity_theft_risk': True,
'operational_impact': 'Closure of courthouse services, disruption '
'of property tax payments and administrative '
'functions',
'systems_affected': 'County courthouse services, administrative '
'functions (Sheriff’s Office)'},
'investigation_status': 'Ongoing',
'motivation': 'Financial gain (ransom)',
'ransomware': {'data_encryption': True,
'data_exfiltration': True,
'ransom_demanded': True,
'ransomware_strain': 'LockBit-based'},
'references': [{'date_accessed': '2026-05-18',
'source': 'SafePay data leak site'}],
'response': {'remediation_measures': 'Most systems restored within a week'},
'threat_actor': 'SafePay',
'title': 'SafePay Ransomware Attack on Harrison County, WV',
'type': 'Ransomware'}