City of Hart listed on genesis ransomware leak site

• Ransomware group: genesis
• Country: United States
• Sector: Government & Defense
• Announcement date: March 7, 2026

Genesis ransomware group claims City of Hart data breach

The City of Hart, a local municipal government, has been listed on the leak site of the ransomware group known as genesis. According to the announcement made on March 7, 2026, the threat actors claim to have successfully breached the organization's systems and exfiltrated a significant volume of data. The group has initiated a countdown, a common tactic used in ransomware extortion, signaling the potential imminent publication of the stolen information.

The incident involves a claim that the stolen data was sourced directly from the organization's file servers. This method of targeting file servers is a common strategy used by ransomware groups to maximize the impact of a breach by accessing centralized repositories of sensitive information. By threatening to release this data publicly, the attackers aim to exert maximum pressure on the victim organization.

Details of the claimed data theft

The genesis group has specified that the volume of data they claim to have obtained is 300 GB. While the total number of files has not been disclosed, the group has provided details regarding the nature of the content they allege to possess. The stolen data is reportedly comprised of various administrative and sensitive categories, including financial records and user-specific information.

The announcement specifically lists several administrative folders and data types that are allegedly contained within the breach. These include:

• Financial data
• Personal data
• Staff files
• Property tax records

Furthermore, the group has mentioned that the data includes user folders and general file server data. Specific examples of administrative directories mentioned in the leak site announcement include folders related to the city council, the energy department, and property taxes, as well as various staff files. This breadth of data suggests that the attackers are targeting a wide array of municipal functions.

About the City of Hart

The City of Hart is a local municipal government located in the state of Michigan, United States. As a local administration, the city is responsible for providing essential public services, maintaining infrastructure, and providing administrative support to its residents. Because of its role in providing these services, the organization manages a variety of sensitive information ranging from resident personal details to critical infrastructure and financial records.

Impact and assessment of the incident

This incident may pose a significant risk of exposure for the personal data of City of Hart employees and citizens. When public institutions are targeted in this manner, the resulting breaches can create opportunities for malicious actors to conduct identity theft or launch highly targeted phishing attacks against the individuals whose data has been compromised. Such attacks often leverage the specific details found in leaked documents to appear more legitimate to the victim.

Because the City of Hart operates within the United States, this incident may trigger legal processes under relevant state laws and existing data protection regulations. The exposure of sensitive municipal data often necessitates formal investigations and mandatory notification processes to comply with legal frameworks designed to protect citizen privacy.

Regarding the threat actor, information concerning the genesis group remains limited. Consequently, their specific motivations and technical capabilities remain uncertain. However, the use of a countdown and the threat of data publication indicates the use of double extortion tactics. In a double extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal the data to threaten its public release, thereby increasing the pressure to pay a ransom.

This type of attack can negatively impact the operational continuity of the organization. To mitigate such risks, organizations in the government and defense sector often focus on robust backup strategies, network segmentation, and continuous monitoring to detect unauthorized access to file servers. Strengthening access controls and implementing strict data governance can also help reduce the potential impact of a successful exfiltration event.