oxparkrec.org Listed by incransom Ransomware Group

On April 25, 2025, the Oxford Parks and Recreation Department in Michigan had 90GB of internal files listed for sale on the leak site of the ransomware group Incransom. The small government agency, which serves families in Oxford Township with parks, sports programs, summer camps, and senior centers, is the latest confirmed victim in a wave of attacks on local public entities.

What Public Reporting Shows

Public reporting indicates the department was hit by a ransomware incident that resulted in both encryption and data exfiltration. The attackers published a sample of the stolen material on their dark-web blog, confirming the breach. Available details list the organization’s annual revenue at roughly $5 million, 25 employees, and a main contact phone number of (248) 628-1720. The exact number of residents and families whose information appears in the 90GB remains unknown, but the files are described as internal operational records.

Industry research from sources such as DoxxScan™ continuous monitoring indicates that local government and recreation departments frequently store names, addresses, phone numbers, email addresses, and payment details for program registrations. When these records are taken, they can be cross-referenced with other breaches to build detailed profiles.

Why This Matters for You and Your Family

If you or your children have ever signed up for a sports league, summer camp, swimming lessons, or senior program through Oxford Parks and Rec, your personal information may now sit in a ransomware data dump. Names, addresses, dates of birth, and phone numbers are exactly the building blocks criminals use to attempt identity theft, loan fraud, or phishing campaigns tailored to look like they come from your local community.

Even though the department is small, the impact reaches every household that uses its services. A single exposed record can lead to spam calls, targeted scams claiming your child’s camp registration is at risk, or worse. Families who reuse passwords across recreation sign-ups, school portals, and email accounts face an elevated risk that one breach quietly escalates into multiple compromised accounts.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at posting generic files. Once internal documents containing staff and participant contact lists are public, opportunistic criminals scrape the data and begin linking it to usernames, gaming handles, and social-media profiles. This creates an identity chain that can expose your home address, children’s names and ages, and even photos from community events.

Credential leaks like this one cascade into account takeovers and doxxing chains, especially when families share email addresses between parent accounts and children’s gaming logins. A seemingly harmless recreation-department spreadsheet can become the first link that lets attackers locate, harass, or impersonate you and your family members online.

Incransom’s Publicly Known Track Record

Public reporting attributes Incransom with emerging in late 2024 as a double-extortion ransomware operation. The group typically gains initial access through phishing emails or exploited remote desktop connections, exfiltrates data before deploying encryption, then posts samples on its leak site with countdown timers demanding payment. Notable prior victims include other small municipalities and community organizations, following a playbook of targeting entities with limited cybersecurity staff and high volumes of personal records. The group’s extortion style combines public shaming on their blog with threats to sell or release the full dataset if the deadline passes.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, family member handles, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password you have used for Oxford Parks and Rec registrations anywhere else it appears, then enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and parent emails exposed in incidents like this.
• Let remediation specialists handle the follow-up work of submitting takedown requests to data brokers and monitoring for signs of further misuse.

The breach of a local parks department shows that even routine community activities can put your family’s information at risk. Staying ahead requires more than changing one password. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting that process now turns a public exposure into a manageable remediation instead of a lingering threat.