Wayne County, Michigan listed on Interlock ransomware leak site

• Ransomware group: Interlock
• Country: United States
• Sector: Government & Defense
• Announcement date: March 1, 2025

The threat group known as Interlock has claimed to have compromised data belonging to Wayne County, Michigan. According to an announcement made on the group's leak site on March 1, 2025, the organization was targeted in a cyberattack that allegedly resulted in a significant data breach.

Details of the alleged attack

The Interlock group listed Wayne County, Michigan on their leak site on March 1, 2025. The group claims to have obtained access to over 130 SQL databases belonging to the institution. While the group has made these claims, the provided screenshot does not contain evidence of the alleged data; it displays only an error page. It is important to note that the group's claims regarding the breach have not been independently verified.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information. The attackers then threaten to leak this stolen data on public or private leak sites if the ransom demands are not met. This pressure tactic is designed to maximize the impact on the victim by threatening their reputation and legal standing.

Claimed data and affected information

The claims made by the Interlock group suggest that the breach involves a wide range of sensitive information. Specifically, the group alleges that they have access to the following types of data:

• SQL databases
• Confidential criminal investigation files
• Personal data of residents

The presence of such diverse data types indicates a potentially broad scope of the alleged compromise. When threat actors target government entities, they often seek out databases that contain a mix of administrative, legal, and personal information to increase their leverage during negotiations.

Organization profile

Wayne County is the most populous county in the U.S. state of Michigan. Including the city of Detroit, this administrative region provides local government services.

Risk assessment and defensive considerations

The alleged incident may pose a significant risk due to the sensitive nature of the public records held by the institution. The exposure of such information could potentially lead to identity theft for residents and compromise ongoing legal proceedings through the exposure of investigation files. Furthermore, such an event could result in a loss of trust in the institution's digital infrastructure and an increase in the risk of secondary attacks.

Because of the sensitive nature of the data involved, data breach notification requirements under US state laws and federal regulations may be triggered. Organizations in the government and defense sector must remain vigilant against such threats, as they handle high-value data that is a primary target for sophisticated threat actors.

To defend against such incidents, organizations typically implement a multi-layered security approach. This includes robust access controls to limit the exposure of sensitive databases, regular auditing of user activities, and the implementation of strong encryption for data both at rest and in transit. Additionally, maintaining offline, immutable backups is a critical component of a modern incident response strategy to ensure data integrity and availability in the event of a successful encryption attack.

Public information about the Interlock group remains limited. As with any reported breach, the full extent of the impact will only be understood once the claims are verified and a thorough forensic investigation is conducted by the affected institution.