tnlottery.com Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have bought tickets, created accounts, or otherwise shared personal details with the Tennessee Lottery may now face questions about whether their information sits among files that a ransomware group says it stole. Public reporting so far gives no confirmed count of individuals affected, yet the mere listing of tnlottery.com by the group known as incransom raises practical concerns about privacy, fraud risk, and the security of lottery-related records.

On 29 January 2025 the site appeared on the group's leak site. The group claims it exfiltrated a large volume of internal data, including a SQL database said to contain private client information. Until independent verification occurs, those assertions remain claims rather than established facts, but they are enough to warrant careful attention from anyone who has dealt with the organisation.

What happened

According to the available record, tnlottery.com was listed by the incransom ransomware group on 29 January 2025. The group states that it carried out a ransomware attack in which internal files were exfiltrated. Its own description characterises the victim as a “USA education lottery” and asserts that it obtained “a lot of DATA” amounting to 750 GB, including a SQL database with private clients information. No independent confirmation of the intrusion method, the precise date of the attack, or the full contents of the claimed archive has been published in the facts at hand. The number of people whose records may be involved is listed as unknown. Public detail on whether systems were encrypted, whether a ransom demand was issued, or whether any data has already been released remains limited.

The group behind it: incransom

Incransom is a ransomware operation that follows the now-common double-extortion model: operators encrypt a victim’s systems while simultaneously copying data and threatening to publish it if payment is not made. Groups of this type typically maintain leak sites where they post victim names, sample files, and countdown timers to pressure organisations into negotiating. Public reporting over recent years has associated incransom with attacks across multiple sectors, often emphasising the volume of stolen data rather than technical sophistication alone. In the present case the group claims to hold 750 GB of material from tnlottery.com; that claim appears on its leak site and has not been independently verified in the facts provided. No further statements attributed specifically to this incident—beyond the volume figure and the mention of a SQL database containing private client information—are recorded here.

Who is tnlottery.com?

tnlottery.com is the public-facing website of the Tennessee Lottery, the state-run lottery operator in Tennessee. Like other U.S. education lotteries, it sells tickets, manages player accounts, processes prize claims, and supports educational funding programmes. Organisations of this kind routinely handle names, addresses, dates of birth, contact details, payment information, and records of winnings or account activity. Because lottery participation often requires identity verification for larger prizes and because many players maintain online accounts, a breach involving such an entity can touch a broad cross-section of the public. The consequential nature of any confirmed exposure therefore stems less from the lottery’s commercial profile and more from the sensitivity of the personal and financial data it necessarily collects to operate legally and securely.

The information in question

The facts name the exposed material only as “internal files exfiltrated in ransomware attack.” The group’s own claim adds that the haul totals 750 GB and includes a SQL database containing private clients information. Beyond that assertion, the exact data types, the structure of any databases, and whether the files contain full customer records, partial extracts, or other internal documents remain undisclosed. Organisations that run state lotteries typically store player registration details, transaction histories, prize-claim documentation, and related administrative records. It is therefore reasonable to expect that any large SQL database of “private clients information” could encompass personally identifiable data, yet the precise contents have not been confirmed by independent sources. Until further disclosure occurs, the scope of what may have left the organisation’s control stays unconfirmed.

What's at stake

For individuals, the primary risks are those that accompany any unauthorised release of personal and financial data: targeted phishing, identity fraud, account takeover, and unwanted contact. Even if only a subset of the claimed 750 GB proves authentic, the presence of client information in a database format can enable more efficient misuse than scattered documents. For the organisation itself, the stakes include operational disruption, potential regulatory scrutiny under state and federal privacy rules, erosion of public trust in a revenue source that funds education, and the longer-term costs of investigation, notification, and remediation. Because the number of affected people is unknown, the full scale of these consequences cannot yet be measured; the uncertainty itself is part of the burden placed on both the lottery and its customers.

What to do if you're exposed

Anyone who has created an account, purchased tickets online, or submitted personal details to the Tennessee Lottery should treat the situation as a prompt for ordinary hygiene rather than panic. Monitor bank and credit-card statements for unfamiliar charges, enable multi-factor authentication on email and financial accounts, and consider placing a fraud alert or credit freeze with the major credit bureaus if you believe sensitive identifiers may be involved. Watch for phishing messages that reference lottery winnings or account problems—such messages often appear after public breach listings. Keep records of any suspicious contact. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; doing so provides one concrete data point while official notifications, if any, are still pending.

AICompiled with AI assistance from public sources and published under our editorial standards.