Box Elder County listed on interlock ransomware leak site

• Ransomware group: interlock
• Country: United States
• Sector: Government & Defense
• Announcement date: August 13, 2025

The interlock ransomware group has listed Box Elder County on its leak site, claiming to have obtained a significant amount of data belonging to the organization. The announcement, which appeared on August 13, 2025, suggests a major data breach targeting the local government entity.

The claimed attack and data leak

According to the claims made by the interlock group, the breach occurred on August 13, 2025. The group has published a directory structure that appears to belong to various departments within the institution. While public information regarding the specific methods and motivations of the interlock group remains limited, the group has claimed to have accessed approximately 4.5 TB of data.

The leaked information is presented through screenshots that reveal a complex organizational structure. The directory includes several specific folders that point toward sensitive administrative and operational functions. Notable folders identified in the leak include 'Backup', 'Shared drives', 'elections', 'Drone Program', and 'FilingCabinet'. Additionally, the presence of a file named 'OWNERSHIP.csv' has been noted in the leaked directory structure.

Affected data types

• Backup data
• Election data
• Administrative files
• Drone program data

Organization profile

Box Elder County is an administrative division located in the northwestern part of the state of Utah, USA. As a local government entity, it manages public services and administrative operations within the county.

Implications and defensive considerations

The alleged leak of data, which reportedly includes election processes and administrative records, may lead to significant disruptions in local government operations. Such leaks targeting public institutions could potentially result in the exposure of citizens' personal information and carry risks of identity theft. Furthermore, it is possible that the leaked data could be utilized for secondary attacks or targeted phishing campaigns against the organization or its constituents.

Given the nature of the data, the institution may face legal obligations under state-level data protection regulations and federal cybersecurity standards in the United States. Because the group's specific methods and motivations are not fully understood, the institution may need to review all systems and enhance its security measures to prevent future incidents.

In the broader context of cybersecurity, ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not only encrypt an organization's systems to demand a ransom for decryption but also steal sensitive data to threaten its public release. This pressure is intended to coerce the victim into paying the ransom to prevent the exposure of confidential information. For government entities, this poses a heightened risk due to the sensitive nature of public records and citizen data.

To defend against such threats, organizations in the government and defense sector typically focus on implementing robust security frameworks. Common defensive steps include maintaining offline or immutable backups to ensure data can be restored without paying a ransom. Additionally, implementing strict access controls, multi-factor authentication, and continuous monitoring of network traffic can help detect and mitigate unauthorized access before large-scale data exfiltration occurs. Regular security audits and employee training regarding phishing attempts are also fundamental components of a modern cybersecurity posture.