Durant City allegedly targeted by Inc Ransom in massive data breach claim

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Government & Defense
• Announcement date: June 17, 2025

Inc Ransom claims to have stolen massive data from Durant City

The ransomware group known as Inc Ransom has listed Durant City on its leak site, claiming to have compromised a significant volume of sensitive information. According to the announcement made on June 17, 2025, the threat actors claim to have exfiltrated over 800 GB of data belonging to the organization. This incident follows a pattern of activity observed from the group, which has been active since mid-2023 and is known for employing double-extortion tactics.

Double-extortion is a common ransomware strategy where attackers do not just encrypt an organization's files to disrupt operations, but also steal sensitive data beforehand. The goal is to pressure the victim into paying a ransom by threatening to leak the stolen information publicly. This method significantly increases the pressure on the target, as the threat of a data leak can cause irreparable reputational and legal damage, even if the organization has robust backups to restore its systems.

In this specific case, the threat actors claim that the city management has remained unresponsive to their demands. As a result of this lack of communication, the group has issued a 48-hour ultimatum to the institution. The potential publication of this data is viewed as a high-severity incident due to the sensitive nature of the information and the public sector status of the victim.

The alleged data includes sensitive personal information

The data allegedly stolen by Inc Ransom is substantial in size and contains highly sensitive information that could impact the privacy of many individuals. While the exact file count has not been specified, the group claims the total volume of the stolen data exceeds 800 GB. The information reportedly includes various types of personally identifiable information (PII) that could be used for malicious purposes.

The specific types of data mentioned in the claim include:

• Passport data
• Address information
• Phone numbers

The exposure of such data poses secondary risks to the citizens of the affected region. Specifically, the availability of passport details, physical addresses, and contact numbers can facilitate identity theft and targeted phishing attacks. In these scenarios, attackers use the stolen information to impersonate individuals or to craft highly convincing fraudulent communications to trick victims into revealing even more sensitive credentials or financial information.

About Durant City

Durant City is a local government entity located in the state of Oklahoma, United States. The city administration is responsible for managing public services and overseeing administrative operations within the region. As a public entity, the organization handles a wide array of citizen data to facilitate essential municipal services and administrative functions.

Impact and assessment of the incident

The severity of this incident is considered high. Given that the victim is a public institution, the breach may lead to significant legal repercussions regarding local data protection standards and regulations. Furthermore, the group's past activities suggest that the publication of this data could result in significant reputational damage and operational disruptions for the institution. The loss of public trust is a common consequence for government entities facing large-scale data exposures.

For organizations operating within the government and defense sector, incidents like this highlight the critical importance of robust cybersecurity frameworks. Protecting sensitive citizen data requires a multi-layered defense strategy. This typically includes implementing strict access controls to ensure that only authorized personnel can reach sensitive databases, and utilizing encryption for data both at rest and in transit. Furthermore, continuous monitoring of network traffic can help detect unauthorized data exfiltration attempts before they reach a massive scale.

Regular security audits and vulnerability assessments are also essential for public sector entities to identify and remediate weaknesses in their infrastructure. Because ransomware groups often target high-value data to maximize extortion leverage, maintaining an updated incident response plan is vital. This plan should include specific protocols for communicating with stakeholders and legal authorities in the event of a confirmed breach, helping to mitigate the legal and reputational fallout that follows such an event.