The OnSolve CodeRED emergency alert system, operated by Crisis24, was disrupted by a cyberattack attributed to the INC Ransomware group. The attack compromised the platform, exposing personal data of users, including names, addresses, email addresses, phone numbers, and passwords, raising concerns about credential reuse across other accounts. The INC Ransom group claimed to have exfiltrated ~1.15 TB of data before encrypting systems, with initial access gained on November 1 and encryption deployed on November 10.Local governments reliant on CodeRED for emergency alerts were forced to seek alternatives, with some (e.g., Douglas County Sheriff’s Office, Colorado) terminating contracts due to privacy concerns, while others (e.g., Craven County, North Carolina) transitioned to temporary solutions like media announcements and social media alerts. Crisis24 is migrating users to a new, audited CodeRED platform, expected to be operational by November 28, but the outage has already disrupted critical emergency communication services across multiple U.S. jurisdictions. The attack also involved failed ransom negotiations, with Crisis24 allegedly offering $150,000, which the group rejected.

The CodeRED emergency notification system, operated by Crisis24, suffered a ransomware attack by the hacker group INCRansom, forcing the company to decommission its legacy infrastructure. The attack disrupted services for multiple organizations nationwide, including the City of Worcester’s AlertWorcester system, rendering it unavailable. The breach resulted in the theft of sensitive user data, including names, addresses, email addresses, phone numbers, and passwords from CodeRED profiles. While Crisis24 is rebuilding the system using backups from March 31, 2025, some user accounts will be missing. The stolen data is being sold by the hackers, though no evidence of it being publicly leaked has been confirmed. Ransom negotiations failed, exacerbating the incident’s impact. The outage has left municipalities and emergency services without critical alert capabilities, posing risks to public safety communication.