sheboyganwi.gov Listed by chort Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target local governments and public-sector websites, using double-extortion tactics that combine encryption with the threat of data leaks. In this climate, listings on criminal leak sites serve as public claims that an organisation has been compromised, even when independent confirmation remains limited. On 31 October 2024 the municipal domain sheboyganwi.gov appeared on the leak site of the ransomware group known as chort, which asserted that internal files and databases had been taken.

Public detail on the incident is sparse. The number of people affected is unknown, the precise method of intrusion has not been disclosed, and the group’s own status note simply reads “Wait for Decision.” What is known is the claim itself: that internal material was exfiltrated. For residents, employees and anyone who has interacted with city services, that claim alone is enough to warrant attention.

What happened

According to the available record, sheboyganwi.gov was listed by the chort ransomware group on 31 October 2024. The listing describes the event as a ransomware attack in which internal files were allegedly exfiltrated. The group’s status field is marked “Wait for Decision,” and the accompanying text repeats the phrase “Databases + Files of This Company.” No confirmed count of affected individuals has been published, no technical indicators of compromise have been released by the city, and no independent verification of the group’s claims has been made public. Timing of the intrusion itself, the initial access vector, and any ransom demand remain undisclosed.

Who is chort?

Chort is a ransomware operation that follows the now-common double-extortion model: after gaining access to a network, operators encrypt systems and simultaneously copy data, then threaten to publish the stolen material on a dedicated leak site if payment is not made. Like other groups in this ecosystem, chort typically posts victim names, sample files and countdown timers to increase pressure. Public reporting on the group has documented prior listings of commercial and public-sector entities, though the exact size of its affiliate network and its preferred initial-access methods are not fully catalogued. In the present case the group claims that databases and files belonging to sheboyganwi.gov were taken; that assertion has not been independently confirmed.

Who is sheboyganwi.gov?

sheboyganwi.gov is the official web presence of the City of Sheboygan, Wisconsin, a municipal government serving residents of Sheboygan County. City websites of this type routinely host or connect to systems that manage property records, utility billing, permits, employee payroll, public-safety records and citizen correspondence. Because local governments sit at the intersection of personal, financial and operational data, a breach claim against such an organisation raises concerns that extend beyond the city administration itself to the people who rely on its services.

What data was at risk

The only data types named in the public record are “internal files” said to have been exfiltrated in a ransomware attack, together with the group’s repeated reference to “Databases + Files.” Exact contents have not been disclosed by either the city or independent investigators. Organisations of this kind typically maintain databases containing resident contact information, tax and property records, employee personnel files, vendor contracts and internal correspondence. Whether any of those categories were among the material claimed by chort remains unconfirmed. The number of people potentially affected is listed as unknown.

Why it matters

When a municipal government is listed on a ransomware leak site, the practical risks fall on both the institution and the individuals whose information it holds. Residents may face identity-theft or fraud attempts if personal details were among the exfiltrated files. City employees could see payroll or personnel data misused. The organisation itself may confront operational disruption, recovery costs and the need to notify affected parties under state and federal rules. Because the listing remains in a “Wait for Decision” state, the data may still be held privately by the group or may later appear in full; either outcome leaves uncertainty that can last months. Even an unconfirmed claim can erode public trust in digital services that citizens are increasingly required to use.

What to do if you're exposed

If you have used city services, paid utility bills online, applied for permits, or are a current or former employee, treat the claim as a prompt for basic hygiene rather than panic. Concrete first steps include:

• Monitor bank and credit-card statements for unfamiliar charges and consider a free credit freeze or fraud alert with the major credit bureaus.
• Change passwords on any accounts that reused credentials associated with city portals, and enable multi-factor authentication wherever it is offered.
• Watch for phishing emails or calls that reference city business, tax refunds or “data-breach assistance,” and never supply personal information in response.
• Retain copies of any official notices the city may later issue; those will contain the most accurate guidance on what was confirmed to have been exposed.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets. Such a scan does not confirm involvement in this specific incident, but it can surface earlier exposures that warrant the same protective measures.

AICompiled with AI assistance from public sources and published under our editorial standards.