City Of Coon Rapids Listed by INC Ransom Ransomware Group

On June 23, 2024, the City of Coon Rapids, Minnesota, appeared on the leak site of the incransom ransomware group. The municipal government that serves more than 62,000 residents now faces public confirmation that internal files were allegedly exfiltrated during a ransomware attack. Anyone whose personal information is held by the city—tax records, permit applications, utility accounts, or employee data—may be affected even though the exact number of impacted individuals remains unknown.

Details from the Leak-Site Listing

The incransom leak site states that the City of Coon Rapids suffered a ransomware intrusion and that attackers successfully exfiltrated internal files. The listing does not quantify the volume of data taken, name specific record types, or disclose ransom amounts. It simply states that files were removed from city systems and warns that they will be published if demands are not met. The disclosure provides no further technical details about the initial access vector or the precise systems compromised.

Why This Matters for You and Your Family

Local governments hold sensitive information on everyday residents: addresses, dates of birth, Social Security numbers used for licensing or benefits, payment histories, and employee payroll data. When these records surface in a ransomware leak, the exposure is permanent. Even if the city later offers credit monitoring, the stolen files can circulate on multiple underground forums for years. For families in Coon Rapids and surrounding suburbs, this single incident can translate into higher risks of identity theft, fraudulent loan applications, or targeted scams that reference local government dealings.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at one dataset. Attackers often cross-reference stolen government files with other breaches to build detailed profiles. A municipal employee’s work email can link to personal accounts; a resident’s utility login can tie a home address to children’s school records or gaming usernames. These identity chains accelerate doxxing, account takeovers, and swatting attempts. Credential leaks of this nature frequently cascade into gaming platforms, where children’s accounts become entry points for further harassment or extortion when the same password or recovery email is reused.