Qilin ransomware group lists morgan911.org on its leak site

• Ransomware group: Qilin
• Country: United States
• Sector: Government & Defense
• Announcement date: July 24, 2025

Qilin ransomware group targets Morgan County 911

The Qilin ransomware group has officially listed Morgan County 911 on its dedicated leak site. In the announcement, the threat actor claims to have successfully breached the organization's network and exfiltrated sensitive information. To support these claims, the group has published several images of documents that are allegedly belonging to the organization, intended to demonstrate the success of their intrusion.

Details of the alleged breach

According to the post published on July 24, 2025, the Qilin ransomware group claims to have gained unauthorized access to the internal network of morgan911.org. The group asserts that they have successfully stolen data from the organization's systems. As part of their public announcement, the group has shared various document samples that are claimed to be related to the organization's internal operational processes.

The shared content includes visual samples of documents that the group claims are part of the organization's internal records. These samples are intended to serve as proof of the breach and to exert pressure on the target. No specific information was provided regarding the total volume of data stolen or the specific number of files compromised during the incident. Furthermore, the group has not disclosed a ransom demand or the specific date the initial access was achieved, though the announcement itself was made on July 24, 2025.

Data types involved in the leak

The screenshots provided by the threat actor allegedly display various types of sensitive information. Based on the samples shared by the group, the following data types are claimed to have been compromised:

• Staff contact information
• Administrative documents
• Operational records

The presence of such information in a public leak site suggests a focus on sensitive internal data that can be used for further malicious activities.

About Morgan County 911

Morgan County 911 is a public organization located in the United States. It provides essential emergency and non-emergency call dispatching services to the residents of Morgan County, Alabama. The agency is dedicated to ensuring public safety by managing a countywide radio system and coordinating ambulance services for the region.

Potential impact and security implications

This alleged breach poses a significant threat to the operational continuity and data security of an organization that provides critical emergency services. The data claimed to be leaked, particularly staff contact information and operational records, could lead to targeted phishing attacks against employees or increase the risks of identity theft. Because the organization operates within the United States, this incident may trigger legal processes under state-level data breach notification laws and federal security standards.

The Qilin group is known for utilizing double-extortion tactics. This method involves not only encrypting an organization's data but also threatening to release stolen information on a leak site to increase pressure on the victim to pay the ransom. Given this pattern, it is possible that the group may release further data to increase the pressure on the organization. The fact that the organization provides vital public safety services may increase the overall severity of the incident and could lead to secondary security risks for the community it serves.

For organizations in the government and public safety sectors, such incidents highlight the importance of robust defensive measures. Common defensive steps include maintaining strict network segmentation to prevent lateral movement, implementing multi-factor authentication across all access points, and conducting regular audits of administrative access. Additionally, maintaining offline, immutable backups is a critical component of a resilient cybersecurity posture to ensure that services can be restored in the event of a ransomware attack.