Union County experienced a ransomware attack between May 6 and May 18, 2025, compromising its computer network. Cybercriminals accessed and exfiltrated highly sensitive personal and financial data of residents, including Social Security numbers, driver’s license IDs, financial account details, dates of birth, fingerprint records, medical information, payment card data, and passport numbers. While the county confirmed the breach, monitoring efforts found no evidence of misuse of the stolen data as of the review completed on August 25, 2025. Notifications to affected individuals began on September 24, 2025. The attack prompted emergency cybersecurity enhancements, such as deploying new security tools, enforcing a county-wide password reset, and tightening external network access controls. Residents were warned about potential fraud and identity theft risks, advised to monitor financial statements, and encouraged to use free credit report services. A dedicated assistance line (1-833-919-4739) was established for queries and support. The county emphasized its commitment to safeguarding data but acknowledged the severe exposure of critical resident information, raising concerns over long-term identity theft and financial fraud risks.
TPRM report: https://www.rankiteo.com/company/union-county-north-carolina
"id": "uni0992709092525",
"linkid": "union-county-north-carolina",
"type": "Ransomware",
"date": "5/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'residents (number not '
'specified)',
'industry': 'public administration',
'location': 'Union County, USA',
'name': 'Union County',
'type': 'government (county)'}],
'customer_advisories': ['Monitor for fraud and identity theft',
'Review account statements regularly',
'Use free credit report services',
'Report suspected identity theft to authorities',
'Contact dedicated assistance line at 1-833-919-4739 '
'for questions'],
'data_breach': {'data_exfiltration': True,
'personally_identifiable_information': True,
'sensitivity_of_data': 'high (includes PII, financial, '
'biometric, and medical data)',
'type_of_data_compromised': ['personal information',
'financial information',
'biometric data (fingerprints)',
'medical information',
'government-issued identifiers '
"(SSN, driver's license, "
'passport)']},
'date_detected': '2025-05-06',
'description': 'Union County officials disclosed a ransomware attack on their '
'computer network in May 2025, resulting in the theft of '
'sensitive resident data. The attackers accessed and extracted '
'personal and financial information, including names, Social '
"Security numbers, driver's license IDs, financial account "
'details, dates of birth, fingerprint data, medical records, '
'payment card information, and passport numbers. The county '
'completed its review of the impacted data on August 25, 2025, '
'and began notifying affected individuals by mail on September '
'24, 2025. No evidence of misuse of the stolen data has been '
'found as of the disclosure.',
'impact': {'brand_reputation_impact': 'Potential reputational harm due to '
'sensitive data breach affecting '
'residents',
'data_compromised': ['names',
'Social Security numbers',
"driver's license ID numbers",
'financial account information',
'dates of birth',
'fingerprint information',
'medical information',
'payment card information',
'passport numbers'],
'identity_theft_risk': 'High (personal and financial data exposed)',
'payment_information_risk': 'High (payment card and financial '
'account information exposed)',
'systems_affected': ['county computer network']},
'initial_access_broker': {'high_value_targets': ['resident personal and '
'financial data']},
'investigation_status': 'Ongoing (no evidence of data misuse found as of '
'disclosure; review completed 2025-08-25)',
'post_incident_analysis': {'corrective_actions': ['Deployment of new security '
'tools',
'County-wide password reset',
'Strengthened external '
'network access '
'restrictions',
'Enhanced monitoring for '
'data misuse']},
'ransomware': {'data_exfiltration': True},
'recommendations': ['Residents advised to monitor for fraud and identity '
'theft',
'Regular review of account statements recommended',
'Utilization of free credit report services encouraged',
'Report suspected identity theft to police or attorney '
"general's office"],
'references': [{'source': 'Union County public disclosure'},
{'source': 'Union County dedicated assistance line'}],
'response': {'communication_strategy': ['public disclosure of incident',
'dedicated assistance line for '
'residents (1-833-919-4739)',
'advisories for residents to monitor '
'fraud and identity theft risks'],
'enhanced_monitoring': 'monitoring internet sources for misuse '
'of stolen data',
'incident_response_plan_activated': True,
'recovery_measures': ['review of impacted data (completed '
'2025-08-25)',
'notification of affected individuals via '
'mail (began 2025-09-24)'],
'remediation_measures': ['deployed new security tools',
'county-wide password reset',
'strengthened restrictions for external '
'network access']},
'stakeholder_advisories': 'County Administrator Bill Narducci stated: '
"'Protecting the confidentiality of the information "
'we hold is a responsibility we take seriously. We '
'will continue to work diligently to enhance our '
"security.'",
'title': 'Ransomware Attack on Union County Computer Network',
'type': 'ransomware'}