City of McMinnville OR Listed by ransomhouse Ransomware Group

On August 06, 2026, the ransomware group RansomHouse listed the City of McMinnville, Oregon on its leak site, claiming the municipality was hit by a ransomware attack in which internal files were exfiltrated. The city has not, as of this writing, issued any public confirmation or breach notification. According to the leak-site listing, data was taken but the exact volume, specific records involved, or number of residents affected remains unknown.

Details from the Leak-Site Claim

The RansomHouse leak page states that the City of McMinnville suffered a ransomware incident and that attackers successfully exfiltrated internal files. The listing does not quantify the number of records, name the specific systems compromised, or list sample data types beyond the general description of “internal files.” Because the sole primary source is the threat actor’s own leak site hosted on an onion domain, this remains an unconfirmed claim. The City of McMinnville has not publicly acknowledged the incident, and no regulator, state attorney general, or federal agency filing has yet appeared.

RansomHouse typically posts a countdown timer and a sample of allegedly stolen data before threatening full publication. At the time of writing the timer was still active, and the precise deadline has not been independently verified.

Why This Matters for You and Your Family

When a city government is targeted, the people who live, work, or do business there are usually the ones whose information ends up at risk. Municipal systems often hold names, addresses, dates of birth, driver’s license numbers, Social Security numbers, tax records, permit applications, utility account details, and employment information for city staff and contractors. Even though the leak-site listing does not specify what was taken, the exposure of any of these records can lead to identity theft, tax fraud, or phishing campaigns tailored to McMinnville residents. If your family has interacted with city services — filed a permit, paid a utility bill, applied for a job with the city, or attended a public-records request — your information may be among the files now in attackers’ hands.

Doxxing and Identity-Chain Risks

Internal municipal files frequently contain more than just names and addresses. They can link email accounts, phone numbers, dates of birth, and physical addresses in ways that let attackers build complete identity profiles. A single leaked city record can connect your driver’s license to your children’s school forms, your spouse’s employment records, or your home utility account. These linkages allow doxxing campaigns that publish your full residential address, phone number, and family relationships online. Gaming accounts used by you or your children are especially vulnerable because the same email or password reused for a city portal can hand over an entire digital life. Once one service falls, attackers pivot to others, rapidly expanding the breach surface for every member of the household.

RansomHouse’s Public Track Record

Public reporting attributes RansomHouse with emerging in late 2021 as a double-extortion ransomware operation. The group is known for breaching organizations across North America and Europe, including municipalities, healthcare providers, manufacturing firms, and educational institutions. Their typical playbook involves initial access through compromised remote desktop protocol accounts or phishing, followed by extensive internal network reconnaissance, data exfiltration, and then encryption. After encryption they demand payment for both decryption and non-disclosure of the stolen files. RansomHouse has repeatedly shown willingness to publish sensitive internal documents when victims do not pay, using their leak site to pressure organizations and their customers or residents.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, usernames, and real-world identity so you can see exactly what chains exist from this and prior exposures.
• Enable continuous DoxxScan monitoring across 13.1 billion breach records and more than 100 platforms so the next time your information appears it is caught within hours rather than months.
• Rotate any password you have ever used on City of McMinnville online portals or related municipal services, and secure every reused account with a hardware-backed or authenticator-based 2FA method.
• Let remediation specialists handle formal takedown requests across data brokers and people-search sites that surface the leaked city records, removing your home address from public circulation where possible.
• Monitor your credit reports, tax transcripts, and children’s credit files for new accounts opened in your names, and place fraud alerts with the major bureaus immediately.

The City of McMinnville ransomware claim is a reminder that local government breaches directly threaten the privacy of ordinary families who rely on those services. Taking deliberate steps now can limit how far attackers can travel down the identity chain created by this and future leaks. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists to help you regain control of your exposed information.