Morgan County 911

Morgan County 911 experienced a cybersecurity incident which disrupted administration systems for several days. While dispatch functions such as radio communications, call history, and CAD systems were not affected, the Sheriff’s Office network was disconnected from the 911 system as a precaution, resulting in the loss of access to the Inmate Roster for a week. The attack was claimed by the ransomware gang Qilin, which uploaded various documents including financial records. The attack was not a phishing incident but more of a brute force attack. No critical systems were affected, and the ability to operate as a 911 Center remained intact.

Source: https://www.comparitech.com/news/morgan-county-911-emergency-services-confirms-ransomware-attack-via-qilin/

TPRM report: https://scoringcyber.rankiteo.com/company/morgan-county-911

"id": "mor558072725",
"linkid": "morgan-county-911",
"type": "Ransomware",
"date": "7/2025",
"severity": "75",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'industry': 'Emergency Services',
                        'location': 'Decatur, Alabama',
                        'name': 'Morgan County 911',
                        'type': 'Government'}],
 'attack_vector': 'Brute Force',
 'date_detected': '2025-05-14',
 'date_resolved': '2025-05-20',
 'description': 'Morgan County 911 experienced a ransomware attack in May '
                '2025, claimed by the Qilin ransomware gang. The attack '
                'disrupted administrative systems but did not affect critical '
                'dispatch functions. The Sheriff’s Office network was '
                'temporarily disconnected from the 911 system as a precaution.',
 'impact': {'downtime': 'Several days',
            'operational_impact': 'Temporary disconnection of Sheriff’s Office '
                                  'network from 911 system',
            'systems_affected': ['Administrative Systems',
                                 'Sheriff’s Office Network']},
 'motivation': 'Financial Gain',
 'ransomware': {'ransomware_strain': 'Qilin'},
 'recommendations': 'Citizens and employees should remain on high alert for '
                    'phishing messages and monitor accounts for suspicious '
                    'activity.',
 'references': [{'source': 'Comparitech'}],
 'response': {'containment_measures': 'Disconnected Sheriff’s Office network '
                                      'from 911 system'},
 'threat_actor': 'Qilin',
 'title': 'Ransomware Attack on Morgan County 911',
 'type': 'Ransomware'}