morgancountyga.gov targeted by Inc Ransom in alleged data leak

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Government & Defense
• Announcement date: April 11, 2026

Inc Ransom claims data leak involving morgancountyga.gov

The ransomware group known as Inc Ransom has announced a data leak involving morgancountyga.gov. According to an announcement made on the group's leak site on April 11, 2026, the threat actor claims to have successfully obtained data belonging to the organization. This claim follows an alleged attack date of March 28, 2026, suggesting that the breach occurred several weeks prior to the public announcement on the leak site.

Details of the alleged event

The threat actor known as Inc Ransom listed morgancountyga.gov on its leak site, claiming to have exfiltrated approximately 330 GB of data from the organization. This significant volume of data suggests that the county's digital infrastructure, which supports essential public services and local government operations, may have been compromised. Such incidents often involve attackers gaining unauthorized access to internal networks to locate and extract sensitive files before making the theft public.

The group's announcement indicates a substantial amount of information has been targeted. While the group has made these claims, the specific nature of the breach remains tied to the group's assertions regarding their access to the organization's systems.

Data and file information

Regarding the specific content of the alleged breach, the group has provided limited details. The screenshot provided by the threat actor indicates a data size of 330,131,676,411 bytes. However, no specific list of data types was provided in the announcement, and no specific file count was mentioned by the group.

• No specific data types were listed in the announcement.

About Morgan County

Morgan County is a local government entity based in Georgia, providing essential public services. It manages public safety through the fire rescue and sheriff's office, while also offering public transit and various community resources for local residents.

Analysis and implications for the sector

This incident may highlight the vulnerability of local government entities to cyberattacks. There is a possibility that the allegedly exfiltrated data contains sensitive information regarding public services and local residents. In accordance with US state laws and federal regulations, the organization may be required to fulfill data breach notification obligations.

Given the double-extortion tactics typically employed by the Inc Ransom group, there may be a risk that the leaked data could be utilized for identity theft or targeted phishing campaigns. Double extortion is a common ransomware tactic where attackers not only encrypt an organization's data but also steal it, threatening to leak the information publicly if a ransom is not paid. This adds a layer of pressure on the victim, as the threat of data exposure remains even if systems are restored from backups.

Such attacks can lead to negative impacts on an organization's operational continuity and public trust. For government entities, maintaining the integrity of digital infrastructure is vital for the delivery of community resources and public safety services. Organizations in this sector often face unique challenges due to the sensitive nature of the resident data they manage and the critical necessity of their continuous operation.