Wayne County Listed by interlock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to single out local governments across the United States, treating public-sector networks as high-value targets because of the sensitive resident and operational data they hold. Against that backdrop, Wayne County in Michigan appeared on the leak site of the interlock ransomware group on 2 October 2024. The listing asserts that internal files were taken in a ransomware attack; the number of people affected remains unknown and independent confirmation of the full scope is not yet public. For residents and employees whose information may sit inside county systems, the claim alone is enough to warrant careful attention.

What follows is a factual account drawn only from the reported listing and established public knowledge of the actor and the sector. Where detail is missing, it is stated as such.

Inside the incident

On 2 October 2024, the interlock ransomware group publicly listed Wayne County as a victim. According to the group’s own statement, the county is located in Michigan and the attackers claim to have obtained more than 130 SQL databases containing a large collection of confidential criminal investigation files and personal data of residents. The only data category confirmed in the public record is “internal files exfiltrated in a ransomware attack.” No technical details of the intrusion method, the precise date of the compromise, the volume of data in bytes, or any ransom demand have been disclosed. The number of individuals whose records may be involved is listed as unknown. At present the listing itself constitutes an unverified claim by the group; no official confirmation or denial from Wayne County has been incorporated into the available facts.

The group behind it: interlock

Interlock is a ransomware operation that follows the now-common double-extortion model: encrypting systems while simultaneously stealing data and threatening to publish it on a dedicated leak site if payment is not made. Public reporting on the group describes a pattern of targeting mid-sized organisations, including government entities, healthcare providers and manufacturers, often after initial access through compromised credentials or unpatched remote services. Once inside a network, operators typically move laterally, identify high-value file shares and databases, exfiltrate selected material, and then deploy encryption. The group’s leak site is used both to pressure victims and to advertise the stolen data to other criminals. Nothing in the public record indicates that interlock has released any of the claimed Wayne County material beyond the listing itself; the group simply asserts possession of the databases and files described above. Prior activity attributed to interlock shows the same reliance on public shaming rather than novel technical methods, making the listing a standard pressure tactic rather than proof of successful monetisation.

About Wayne County

Wayne County is a local government jurisdiction in the state of Michigan. Like other U.S. counties it administers a range of public services that routinely generate and store large volumes of personal and operational records: property assessments, court filings, law-enforcement case files, vital records, social-service case notes and employee personnel data. Criminal investigation files in particular often contain witness statements, suspect identifiers, forensic reports and other material that is both sensitive and long-lived. Because county systems sit at the intersection of public safety and resident services, a breach can affect not only individual privacy but also the integrity of ongoing investigations and the continuity of essential government functions. The listing therefore carries weight beyond a typical commercial incident precisely because of the nature of the organisation involved.

The information in question

The interlock listing states that more than 130 SQL databases were taken, along with a large collection of confidential criminal investigation files and personal data of residents. Beyond that description the exact contents remain unconfirmed. Organisations of this type typically hold names, addresses, dates of birth, Social Security numbers, driver’s-licence details, financial account information linked to tax or benefit systems, medical or social-service records, and detailed law-enforcement case materials. Whether any or all of those categories are present in the claimed exfiltration cannot be verified from the public facts. The only firm statement is that internal files were removed during a ransomware attack; the group’s additional claims about the databases and criminal files should be treated as assertions rather than established inventory.

Why it matters

If the claimed data are authentic, residents face concrete risks of identity theft, targeted fraud and unwanted contact. Criminal investigation files can expose witnesses, victims or suspects to harassment or retaliation, and can compromise the integrity of open cases. For the county itself, the loss of internal files may disrupt day-to-day operations, require costly system rebuilds and erode public trust in the handling of sensitive records. Even when a ransom is not paid, the mere existence of the data on a criminal marketplace can lead to secondary sales and long-term exposure. Because the number of affected individuals is unknown, the practical impact cannot yet be quantified, but the categories of information typically held by a county government make the potential harm both personal and institutional.

If your data was in this claimed breach

Residents and employees who believe their information may have been held by Wayne County should take measured steps. Monitor bank and credit-card statements for unfamiliar activity and consider placing a free fraud alert or credit freeze with the major credit bureaus. Change passwords on any accounts that reused credentials associated with county services, and enable multi-factor authentication wherever it is offered. Review any notices the county may issue for official guidance on credit monitoring or identity-protection services. Finally, readers can run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan provides an early indicator of wider exposure even when the precise contents of this incident remain unconfirmed.

AICompiled with AI assistance from public sources and published under our editorial standards.