City Of Coon Rapids Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target local governments across the United States, exploiting the sensitive data these agencies hold and the operational pressure they face to restore services quickly. In this environment, listings on criminal leak sites have become a common signal that an organization may have suffered an intrusion, even when independent confirmation remains limited.

On June 23, 2024, the City of Coon Rapids was listed by the ransomware group known as incransom. Public reporting indicates that internal files were exfiltrated during a ransomware attack. The number of people affected has not been disclosed, and further technical details remain limited. For residents and employees of a Minnesota city serving more than 62,000 people, any such claim raises practical questions about personal data and municipal continuity.

What happened

According to available records, the City of Coon Rapids appeared on the incransom leak site on June 23, 2024. The group claims the city was the victim of a ransomware attack in which internal files were exfiltrated. No public figure has been released for the number of individuals affected, and the precise method of initial access, the duration of the intrusion, and the full scope of systems involved have not been disclosed. The listing itself constitutes a claim by the threat actor rather than an independently verified confirmation of every asserted detail.

Municipal ransomware incidents of this type typically involve encryption of systems combined with data theft, followed by a threat to publish the stolen material if demands are not met. In this case, only the fact of the listing and the description of internal-file exfiltration are on record; additional operational specifics remain undisclosed.

Who is incransom?

Incransom, also referred to as INC Ransom, is a ransomware operation that has been active in recent years and is known for double-extortion tactics: encrypting victim systems while simultaneously stealing data and threatening to leak it. The group has previously listed a range of organizations, including private companies and public-sector entities, on its dedicated leak site. Like many contemporary ransomware crews, it is believed to operate with affiliates who gain initial access and then deploy the ransomware payload, though the precise internal structure of the group is not fully public.

Public reporting on incransom has noted its use of standard ransomware techniques—phishing, exploitation of remote-access services, and lateral movement once inside a network—followed by data exfiltration and encryption. The group’s leak-site posts serve both as pressure on victims and as advertising of its capabilities. In the present case, the listing of the City of Coon Rapids is presented by the group as evidence of a successful attack; independent verification of every claim made on such sites is often incomplete at the time of publication.

Who is City Of Coon Rapids?

The City of Coon Rapids is a municipal government in Minnesota, located approximately 15 miles north of Minneapolis. It serves a population of 62,435 residents and operates under a Council/Manager form of government, in which an elected council sets policy and a professional city manager implements it. Like other mid-sized American cities, Coon Rapids provides a range of local services including public safety, public works, community development, recreation, and administrative functions that generate and store substantial volumes of resident and employee information.

Local governments routinely maintain records related to property taxes, utility accounts, permits, court or code-enforcement matters, employee payroll and benefits, and resident communications. A breach affecting such an agency is consequential because the data often includes personally identifiable information that citizens cannot easily change, and because disruption of city systems can affect everyday services. The city’s own public description emphasizes community strength and service to residents; any compromise of its internal systems therefore carries both privacy and operational implications.

What was likely exposed

Public details state only that internal files were exfiltrated in a ransomware attack. No inventory of specific file types, databases, or individual records has been released, and the number of people whose information may be involved remains unknown. Organizations of this kind typically hold employee personnel files, resident contact and billing data, permit and licensing records, internal correspondence, and operational documents. Whether any of those categories were among the files taken has not been confirmed.

Because the exact contents are unconfirmed, it is not possible to state with certainty which data elements—if any—were exposed. Readers should treat claims of specific data types as unverified unless and until the city or independent investigators provide further detail.

What's at stake

For individuals, the principal risk is the potential misuse of personal information that may have been present in the exfiltrated files. Even when the precise data set is unknown, municipal records can contain names, addresses, dates of birth, Social Security numbers, financial account details, or other identifiers that enable identity theft, targeted phishing, or fraud. Residents and employees may face long-term monitoring burdens if sensitive records were involved.

For the city itself, the stakes include operational disruption, the cost of incident response and system restoration, potential regulatory notification obligations, and erosion of public trust. Local governments often operate with constrained cybersecurity budgets and legacy systems, which can prolong recovery. The absence of confirmed victim counts or data inventories leaves both the public and the organization in a period of uncertainty while investigations continue.

Were you affected?

If you live or work in Coon Rapids, or have had recent dealings with the city that involved submitting personal information, treat the possibility of exposure seriously until more details emerge. Monitor financial accounts and credit reports for unusual activity, be alert to phishing messages that reference city services, and consider placing a fraud alert with the major credit bureaus. The city may issue official notifications if it determines that specific resident or employee data was compromised; follow any guidance provided through official channels.

As a practical first step, you can run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets. This does not confirm or rule out involvement in the Coon Rapids incident, but it can surface other exposures that warrant attention while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.