Sedgwick Government Solutions targeted by TridentLocker ransomware group

• Ransomware group: TridentLocker
• Country: United States
• Sector: Government & Defense
• Announcement date: December 30, 2025

The threat actor group known as TridentLocker has officially listed Sedgwick Government Solutions on its dedicated leak site. According to the announcement made by the group, the organization has been targeted in a data breach, with the attackers claiming to have successfully exfiltrated a significant volume of sensitive information.

Details of the claimed attack

The incident was announced on December 30, 2025, coinciding with the date the group claims the attack took place. TridentLocker asserts that they have obtained a total of 2,947 files during the breach. The volume of the stolen data is estimated by the group to be approximately 3.39 GB in size. The leak announcement includes download links for various archive files that allegedly contain critical information belonging to the organization.

Publicly available information regarding the specific tactics, techniques, and procedures of the TridentLocker group remains limited. This lack of public data makes it difficult to attribute the attack to a specific known campaign or to understand the full scope of the group's operational capabilities. The group's primary method appears to involve the public disclosure of stolen data to exert pressure on the victim organization.

Data types involved in the leak

The files released by the attackers are described as containing a variety of sensitive organizational and technical information. The leaked archives reportedly include several categories of data that could impact the organization's internal operations and security posture. The specific items mentioned in the leak announcement include:

• IT infrastructure data
• Certificates
• Corporate documents

In addition to these categories, the group claims the archives contain LHI copies, NVRS records, and SCA documents. The presence of such diverse data types suggests a broad scope of access within the victim's environment.

About Sedgwick Government Solutions

Sedgwick Government Solutions is an organization that provides professional services and solutions to US government agencies and the defense sector. The company carries out operational support and consulting activities for public sector projects. Given its role in supporting government and defense operations, the organization occupies a sensitive position within the US public sector infrastructure.

Analysis and potential impact

This leak may pose significant risks to the organization's operational security and its various partnerships within the defense sector. Because the organization is based in the United States, the incident could trigger legal processes under federal data protection regulations and contractual obligations, depending on the actual nature of the exposed data. The disclosure of IT-related data is particularly concerning, as it may create an entry point for secondary attacks or targeted phishing campaigns against the organization's networks.

Furthermore, the exposure of data related to the defense sector could have long-term negative impacts on supply chain security. When organizations involved in critical infrastructure or defense are compromised, the ripple effects can extend to their partners and the government agencies they serve. The group's method of making data publicly available is a common tactic used in double extortion ransomware attacks, where the goal is to maximize psychological and reputational pressure on the target.

In such scenarios, organizations typically focus on incident response, forensic investigation, and strengthening perimeter defenses. Defensive measures often include implementing multi-factor authentication, enhancing network segmentation to prevent lateral movement, and conducting regular audits of access controls. For organizations operating within the defense sector, maintaining rigorous compliance with federal security standards is a critical component of mitigating the long-term risks associated with supply chain vulnerabilities.