City of Florence, Alabama Listed by doppelpaymer Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 5, 2020, the City of Florence, Alabama was listed on a data-leak site maintained by the DoppelPaymer ransomware group. The entry states that internal files were taken during a ransomware operation, though the number of people affected and the precise contents of those files have not been publicly confirmed. This listing forms part of a documented increase in ransomware activity directed at municipal governments, where operators seek both encryption payments and leverage from threatened data disclosure.

What happened

The City of Florence, Alabama was added to the DoppelPaymer leak site on June 5, 2020. The group claims to have exfiltrated internal files in the course of a ransomware attack. No further details on the timing of the intrusion, the volume of data, the encryption status of city systems, or any ransom demand have been released by the city or confirmed through independent reporting. The number of individuals potentially affected remains unknown.

Who is doppelpaymer?

DoppelPaymer is a ransomware operation that became publicly active in 2019. It functions through a double-extortion model in which files are encrypted on targeted systems and copies are removed for later publication if payment is not received. The group has been linked to earlier campaigns against businesses and public-sector organizations in multiple countries. Its leak sites serve as a platform to advertise claimed acquisitions and apply pressure on victims. Attribution of any specific incident rests on the group’s own statements unless corroborated by the affected organization or law-enforcement findings.

Who is City of Florence, Alabama?

The City of Florence is a municipal government in northwest Alabama responsible for public services including utilities, public safety, permitting, and records management. Like other local governments, it maintains databases that can contain resident names, addresses, tax and utility payment information, and internal administrative correspondence. A breach at this scale is consequential because municipal records often include data that cannot be easily changed and that supports essential public functions.

The information in question

The only detail provided in the listing is that internal files were taken. The exact categories of data, file counts, or time periods covered have not been disclosed. Municipal organizations of this type routinely hold personal identifiers, financial account references, and operational records; however, whether any of those specific categories appear in the exfiltrated material remains unconfirmed.

Why it matters

Exposure of municipal records can create long-term privacy and identity risks for residents whose information appears in city systems. Even without Reported Details on the files, the presence of a listing on a ransomware leak site signals that data once held in confidence may now circulate among actors who trade or misuse such material. For the city, the incident adds operational costs related to investigation, potential system restoration, and any required notifications, regardless of whether a ransom was paid.

What to do if you're exposed

Residents concerned about possible exposure should review account statements for unusual activity, enable multi-factor authentication on city-related online portals, and consider placing a credit freeze if financial records may be involved. Checking official notifications from the City of Florence remains the primary source of verified information. Individuals can also run a free exposure scan of their email address against known breach data sets to determine whether their information has appeared in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.