co.grant.mn.us Listed by lockbit3 Ransomware Group

On September 11, 2023, the City of Grant, Minnesota, appeared on the LockBit 3.0 leak site with the claim that internal files had been exfiltrated during a ransomware attack. Residents whose personal information passes through city systems, from property records to permitting documents, are now at elevated risk even though the exact number of affected individuals remains unknown.

Primary Disclosure Details

The LockBit 3.0 leak site listing states that the City of Grant suffered a ransomware intrusion and that attackers successfully removed internal files. The disclosure does not quantify the volume of data taken, list specific record counts, or itemize the file types beyond the generic description of internal files exfiltrated. No ransom demand figure is published on the listing, and the notification does not specify which city departments or databases were compromised. The incident was first indexed on the leak site on September 11, 2023, and the City of Grant, located in Washington County on the eastern edge of the Twin Cities metro area, has not released a separate public breach notification detailing the scope.

Why This Matters for You and Your Family

When a municipal government loses control of internal files, the exposure often includes documents that contain names, addresses, dates of birth, driver’s license numbers, and financial details tied to local services. For families in the Grant area this can mean tax records, building permits, utility accounts, or law-enforcement interactions that suddenly become public. Even without an exact count of impacted records, the breach creates a persistent risk because municipal data frequently links multiple family members at the same household address. Once that information circulates on dark-web forums, it can be combined with other leaks to build detailed profiles that criminals use for identity theft, fraudulent loan applications, or targeted phishing campaigns against you or your children.

Doxxing and Identity-Chain Risks

Internal municipal files rarely exist in isolation. A single leaked address or phone number can be cross-referenced with gaming usernames, school records, or social-media handles to create an identity chain that reaches every member of a household. Children’s gaming accounts are especially vulnerable because the same email or password reused for a city portal may also protect an Xbox, Roblox, or Fortnite profile. Attackers routinely follow these chains to doxx families, publish home addresses alongside names and photos, or hijack accounts for further extortion. The longer the gap between the breach and discovery, the more time criminals have to map these connections and weaponize them.

LockBit 3.0 Track Record

Public reporting attributes the LockBit 3.0 variant to a ransomware operation that first emerged in 2019 under the original LockBit name and rebranded through successive versions. The group has targeted organizations across sectors including local governments, healthcare providers, and manufacturers. Their standard playbook involves initial access through phishing, remote-desktop protocol brute force, or exploited vulnerabilities, followed by exfiltration of sensitive files before encryption. LockBit 3.0 operators typically publish a sample of stolen data on their leak site and set a deadline for payment, threatening full publication or sale of the remaining archive if the victim does not pay. While some victims quietly negotiate, many municipal entities face pressure to restore critical services quickly, sometimes leaving residents exposed for weeks or months before the full impact is understood.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours rather than months.
• Rotate any password you have used on co.grant.mn.us or related city portals and enable 2FA through an authenticator app everywhere that credential is reused.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts which often chain back to the same address or email.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing day-to-day accounts.

The City of Grant breach illustrates how quickly a single municipal ransomware incident can ripple outward into long-term identity exposure for every resident. Acting promptly on the credentials and documents already circulating can limit damage before criminals complete their identity chains. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts at risk from cascading credential leaks like this one.