Union County experienced a ransomware attack between May 6 and May 18, 2025, compromising its computer network and exfiltrating sensitive resident data. The stolen information included personal and financial details names, Social Security numbers, driver’s license IDs, financial account data, dates of birth, fingerprints, medical records, payment card details, and passport numbers. While the county confirmed the breach, monitoring efforts found no evidence of misuse as of the disclosure. Notification to affected individuals began on September 24, 2025, following a data review completed on August 25, 2025. The county responded by enhancing cybersecurity defenses, including deploying new security tools, enforcing a county-wide password reset, and tightening external network access controls. Residents were advised to monitor for fraud and identity theft, with support offered via a dedicated assistance line (1-833-919-4739). The attack underscored vulnerabilities in government data protection, though no operational disruptions (e.g., service outages) were reported. The focus remains on mitigating long-term risks like identity fraud and reputational damage.
TPRM report: https://www.rankiteo.com/company/union-county
"id": "uni0633706092525",
"linkid": "union-county",
"type": "Ransomware",
"date": "5/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"{'affected_entities': [{'industry': 'public administration',
'location': 'Union County, USA',
'name': 'Union County',
'type': 'government'}],
'customer_advisories': 'Mail notifications sent to affected individuals; '
'public advisory issued for fraud vigilance',
'data_breach': {'data_exfiltration': True,
'personally_identifiable_information': True,
'sensitivity_of_data': 'highly sensitive',
'type_of_data_compromised': ['personal information',
'financial information',
'biometric data (fingerprints)',
'medical information',
'government-issued identifiers '
"(SSN, driver's license, "
'passport)']},
'date_detected': '2025-05-06',
'description': 'Union County officials disclosed a ransomware attack on their '
'computer network in May 2025, resulting in the theft of '
'sensitive resident data, including personal and financial '
'information. The attack occurred between May 6 and May 18, '
'2025. The county has since implemented enhanced cybersecurity '
'measures, including new security tools, a county-wide '
'password reset, and stricter external network access '
'restrictions. Affected individuals were notified by mail '
'starting September 24, 2025, and a dedicated assistance line '
'(1-833-919-4739) was established for support.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'sensitive data breach',
'data_compromised': ['names',
'Social Security numbers',
"driver's license ID numbers",
'financial account information',
'dates of birth',
'fingerprint information',
'medical information',
'payment card information',
'passport numbers'],
'identity_theft_risk': 'High (personal and financial data exposed)',
'payment_information_risk': 'High (payment card and financial '
'account information exposed)'},
'initial_access_broker': {'data_sold_on_dark_web': 'No evidence found (as of '
'disclosure)',
'high_value_targets': ['resident personal data',
'financial records']},
'investigation_status': 'Completed (data review finished 2025-08-25)',
'post_incident_analysis': {'corrective_actions': ['deployed new security '
'tools',
'county-wide password reset',
'strengthened external '
'network access '
'restrictions']},
'ransomware': {'data_exfiltration': True},
'recommendations': ['Residents advised to monitor account statements for '
'fraud',
'Utilize free credit report services',
'Report suspected identity theft to police or attorney '
"general's office"],
'references': [{'source': 'Union County Public Disclosure'}],
'response': {'communication_strategy': ['mail notifications to affected '
'individuals (starting 2025-09-24)',
'dedicated assistance line '
'(1-833-919-4739)',
'public advisory for vigilance '
'against fraud/identity theft'],
'containment_measures': ['county-wide password reset',
'strengthened restrictions for external '
'network access'],
'enhanced_monitoring': 'monitoring internet sources for misuse '
'of stolen data',
'incident_response_plan_activated': True,
'remediation_measures': ['deployed new security tools']},
'stakeholder_advisories': 'Dedicated assistance line (1-833-919-4739) '
'established for questions',
'title': 'Ransomware Attack on Union County Computer Network',
'type': 'ransomware'}