RansomHub ransomware group lists www.cityoftarrant.com on its leak site

• Ransomware group: RansomHub
• Country: United States
• Sector: Government & Defense
• Announcement date: February 15, 2025

The RansomHub ransomware group has published a dataset on its leak site that it claims belongs to the City of Tarrant. The announcement, made on February 15, 2025, suggests a significant compromise of the municipal entity's digital infrastructure.

The details of the claimed attack

According to the announcement released by the threat actor known as RansomHub, the group claims to have compromised the systems of the City of Tarrant on February 15, 2025. The group has shared a dataset that they allege was obtained directly from the institution's internal systems. This dataset reportedly consists of approximately 25,397 files.

While the specific method of initial access remains unconfirmed, the group provided screenshots in their post to support their claims. These visual aids suggest that the exfiltrated information includes highly sensitive documentation related to municipal operations and public safety. The timing of the leak coincides with the date the group claims the attack occurred.

The types of data allegedly exfiltrated

The leaked data, as claimed by the RansomHub group, encompasses a wide range of sensitive administrative and law enforcement records. The information appears to touch upon various critical municipal functions, from public safety to financial procurement. The specific items identified in the leak include:

• Law enforcement incident reports
• Traffic accident records
• Victim personal data
• Personnel training records
• Procurement invoices

The breadth of this data suggests that the breach may have touched multiple departments within the city administration, potentially exposing both internal operational details and sensitive information regarding private citizens.

About the City of Tarrant

The City of Tarrant is a local government entity located in the state of Alabama, United States. As a municipal administration, it is responsible for providing essential services to its residents, including public safety, infrastructure management, and various other municipal services necessary for the community's daily operations.

Analysis and potential impact

This breach may pose significant risks to the institution's operational security and the privacy of the personal data belonging to its citizens. The publication of law enforcement reports and information regarding victims could potentially lead to identity theft or targeted phishing attacks against the affected individuals. Furthermore, the institution may face legal obligations under state-level data protection laws and privacy regulations that are applicable to local governments within the United States.

RansomHub is identified as a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. It has been reported that the group absorbed affiliates from the ALPHV group. Because of this background, the group may be inclined to utilize double-extortion tactics, a method where attackers not only encrypt data but also threaten to leak it to pressure the victim into paying. Double extortion is a common tactic used by modern ransomware groups to increase their leverage during negotiations.

Although the group's activities were reported to have ceased in early 2025, the leaked data is considered significant because it contains sensitive information regarding the institution's supply chain and internal operations. For organizations in the government and defense sector, such incidents highlight the necessity of robust cybersecurity frameworks. Defensive steps often include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of phishing and unauthorized access.