Ajuntament de Castelló Listed by ransomexx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In the current threat landscape, ransomware operators have increasingly focused on public-sector entities, where operational disruption and the potential exposure of administrative records can create leverage for extortion. On September 9, 2021, the Ajuntament de Castelló appeared on the leak site maintained by the ransomexx group. The group claims to have stolen internal data during a ransomware incident, though the number of people affected and the precise volume of material remain undisclosed.

What happened

The incident came to public notice when the Ajuntament de Castelló was listed on the ransomexx ransomware leak site on September 9, 2021. According to the listing, the group claims to have exfiltrated internal files as part of a ransomware attack. No further details on the timing of the intrusion, the method of initial access, or the scale of the data removal have been released by the organisation or confirmed through independent reporting. The number of individuals whose information may be involved is not publicly stated.

Inside ransomexx

Ransomexx is a ransomware operation that has conducted campaigns against organisations in multiple countries. Like other groups employing double-extortion tactics, it typically encrypts systems and threatens to publish stolen material unless a ransom is paid. The group maintains a leak site where it lists victims and, in some cases, posts samples of claimed data. Its activity has been documented by cybersecurity researchers through victim announcements and infrastructure analysis, though specific claims made about any single target require independent verification.

About Ajuntament de Castelló

The Ajuntament de Castelló is the municipal government of Castelló de la Plana, a city in eastern Spain. Like other local authorities, it manages public services, administrative records, citizen registrations, and internal operational systems. Public-sector bodies of this type routinely process data related to residents, employees, contracts, and local infrastructure. A compromise affecting such an organisation can therefore intersect with both day-to-day municipal functions and the personal information of individuals who interact with the council.

The information in question

The only data category referenced in connection with the listing is internal files exfiltrated during the ransomware attack. No inventory of specific document types, databases, or file categories has been published. Organisations of this kind commonly hold administrative correspondence, personnel records, service requests, and financial documentation, yet the exact contents of the material claimed by the group are unconfirmed.

The real-world impact

For residents and staff, the primary concern is the possible circulation of internal documents that may contain identifying details or operational information. Local government systems often support essential services, so any related operational disruption could affect routine administrative processes. The organisation itself faces the task of assessing the scope of any exfiltration and managing subsequent remediation without confirmed public figures on the volume of data involved.

What to do if you're exposed

Individuals concerned about possible exposure should monitor official statements from the Ajuntament de Castelló for any guidance on affected services or data. Practical first steps include reviewing bank and government account statements for unusual activity and enabling multi-factor authentication on any online services linked to the municipality.

• Change passwords for any municipal or related online accounts.
• Watch for official notifications from the council regarding follow-up actions.
• Run a free exposure scan of your email address against known breach data to check for appearances in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.