co.grant.mn.us Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 11, 2023, the domain co.grant.mn.us, associated with the City of Grant in Minnesota, was listed by the lockbit3 ransomware group. According to the group's claim, internal files were exfiltrated in a ransomware attack. The number of people affected is unknown, and public detail on the incident remains limited.

Municipal governments hold records that touch residents, employees, and local services. When a ransomware group claims to have taken internal files from such an organization, the practical concern is what those files contained and whether personal or operational data could be misused. At present, only the listing and the stated fact of internal-file exfiltration are on record.

What happened

Public reporting states that co.grant.mn.us was listed by lockbit3 on September 11, 2023. The available summary indicates that internal files were exfiltrated in a ransomware attack. No confirmed figures have been released for the volume of data taken, the precise date the intrusion began or ended, the initial access method, or whether systems were encrypted in addition to data theft. The number of individuals affected is listed as unknown. Beyond the group's leak-site claim and the description of internal-file exfiltration, further technical or operational details have not been disclosed in the material available for this account.

Who is lockbit3?

Lockbit3 is a well-documented ransomware operation that has appeared repeatedly in public breach reporting. Groups operating under the LockBit name typically run a ransomware-as-a-service model: affiliates gain access to victim networks, exfiltrate data, and deploy encryption, after which the operators pressure the victim by threatening to publish stolen material on a dedicated leak site. LockBit variants have been linked to attacks across many sectors, including government and local public bodies, and the group has historically posted victim names and sample data to support its claims. In this case, the listing of co.grant.mn.us constitutes the group's claim that it conducted the attack and removed internal files; that claim has not been independently verified in the facts provided here, and no additional statements attributed specifically to lockbit3 about this victim are on record.

Who is co.grant.mn.us?

co.grant.mn.us is the web domain associated with the City of Grant, Minnesota. Public description places the city on the eastern fringe of the Twin Cities' urban core area within west central Washington County. As a municipal government, it performs the ordinary functions of a small city: administration, local services, permitting, public records, and interaction with residents and employees. Organizations of this type routinely maintain databases and document stores that can include names, addresses, contact details, property or tax-related information, employee records, and internal correspondence. A breach claim against such an entity matters because the data, if genuine and sensitive, can affect both the continuity of local government operations and the privacy of people who deal with the city.

What was likely exposed

The facts name the exposed material only as internal files exfiltrated in a ransomware attack. No inventory of file types, record counts, or specific data categories has been published in the available record. Exact contents therefore remain unconfirmed. Organizations of this kind typically hold a range of information that could appear in internal files; the following points reflect that general pattern rather than verified contents of this incident:

• Administrative and operational documents used in day-to-day city business
• Records relating to residents, property, or local services
• Employee or contractor information maintained for payroll, benefits, or personnel management
• Internal correspondence, meeting materials, or planning files

None of the above should be read as a confirmed list of what lockbit3 obtained. Until the city or another authoritative source provides a clearer accounting, the scope of exposure stays limited to the stated claim of internal-file exfiltration.

Why it matters

For residents and others whose information may sit in city systems, the primary risk is misuse of personal details if those details were among the taken files—identity fraud, targeted phishing, or unwanted contact. Even when the precise data set is unknown, the possibility alone warrants ordinary caution. For the City of Grant, a ransomware incident that includes exfiltration can disrupt internal work, require forensic and recovery effort, and create ongoing uncertainty about what left the network. Because the number of people affected is unknown and the file contents are not detailed publicly, both the human and organizational impact remain difficult to quantify from open sources alone. The incident also illustrates the broader pattern in which local governments, often with constrained security resources, appear on ransomware leak sites.

If your data was in this claimed breach

If you have had dealings with the City of Grant—as a resident, employee, contractor, or service user—treat the possibility of exposure seriously until more is known. Monitor financial and government-related accounts for unfamiliar activity, be alert to phishing that references local services or personal details, and consider placing fraud alerts with major credit bureaus if you believe sensitive identifiers could have been involved. Keep records of any suspicious contacts. You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. Official updates from the city, if issued, should be followed for any specific guidance or credit-monitoring offers tied to this event.

AICompiled with AI assistance from public sources and published under our editorial standards.