ECN
Company Details
Linkedin ID:
emergency-communications-network-llc
Website:
Employees number:
56
Number of followers:
1,019
NAICS:
5415
Industry Type:
Homepage:
onsolve.com
IP Addresses:
0
Company ID:
EME_1001399
Scan Status:
In-progress
Emergency Communications Network Company CyberSecurity Posture
onsolve.com
Effective June 5, 2017 Emergency Communications Network (ECN) has changed to OnSolve. Combining ECN, MIR3 and SendWordNow, establishes OnSolve as the market leader in cloud-based communication and collaboration tools for delivering critical notifications, enhancing business continuity, and improving enterprise-wide productivity. Please follow OnSolve for all future updates and posts and visit us online at www.onsolve.com to learn more. --------- Emergency Communications Network (ECN) is the leading provider of Software as a Service (SaaS) technology designed to help public and private sector enterprises keep employees, citizens, and stakeholders better informed and safe across the United States and Canada. Our sophisticated infrastructure allows our clients – many of whom have been with us for more than a decade – to deliver thousands of critical messages within minutes via voice, text, email, social media, and mobile app alerts. ECN has invested millions of dollars in its infrastructure to ensure clients have access to our services 24/7/365, without fail, from anywhere. ECN Launcher allows authorized personnel to initiate messages from anywhere via smartphones or tablets, giving agencies, departments and businesses the power to communicate to the right people, at the right time, regardless of the situation. Our flagship product CodeRED®, enables local government and public safety officials to communicate time-sensitive, personalized messages using a multimodal approach to its residents and staff. Our SmartNotice® solution serves as a business continuity tool to disseminate critical information to employees or other stakeholders in an easy, reliable, and affordable manner. ECN is headquartered in Ormond Beach, Florida and remains committed to its mission to help alert, inform and affect lives.
Emergency Communications Network A.I CyberSecurity Scoring
ECN Risk Score (AI oriented)Between 0 and 549
ECN
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
ECN Global Score (TPRM)XXXX
ECN
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
ECN Company CyberSecurity News & History
Past Incidents
12
Attack Types
2
CodeRED
Cyber Attack
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The **Douglas County Sheriff’s Office** halted the use of **CodeRED**, an emergency alert system, after discovering a **cyberattack and data breach** that compromised customer information. The breach was detected on **November 21**, though system outages were reported two weeks prior without confirmation. While the stolen data has not been publicly leaked, authorities warn that **personal information of CodeRED users may have been exposed**, prompting recommendations to monitor credit reports. The breach affected **hundreds of agencies nationwide**, forcing multiple counties (including Weld and Park) to abandon the platform. Douglas County is now relying on **door-to-door notifications, social media, and alternative alert systems** (like IPAWS) while transitioning to a new provider. The incident has disrupted critical emergency communications, as CodeRED was previously used for **evacuation orders, shelter-in-place alerts, and wildfire warnings**. Users must re-register for any new system, as their data will not transfer automatically. The breach has eroded trust in the platform’s security, leaving communities vulnerable during emergencies.
OnSolve (CodeRED by Crisis24)
Cyber Attack
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: OnSolve’s **CodeRED** platform, used by **Craven County** for public emergency alerts, suffered a **targeted cyberattack** in November by an organized cybercriminal group. The attack resulted in the **removal of user data** from the system, including **names, addresses, email addresses, phone numbers, and passwords** associated with OnSolve CodeRED profiles. While there is **no current evidence** of the data being published online, the **risk of future leaks persists**, exposing users to potential credential stuffing or identity theft if passwords were reused across accounts. The **entire OnSolve CodeRED system was decommissioned nationwide**, disrupting emergency alert services for Craven County and other municipalities relying on the platform. A **new CodeRED system** was deployed after a security audit and penetration testing, but the incident forced the county to temporarily rely on **alternative alert methods** (local media, county website, and social media). The breach was **isolated to the third-party vendor’s environment**, with no impact on Craven County’s internal systems. Users were advised to **change passwords** for any accounts sharing credentials with CodeRED profiles.
Crisis24 (OnSolve CodeRED)
Cyber Attack
Rankiteo Explanation
Attack threatening the organization's existence
Description: Crisis24, the owner of the **CodeRED** emergency alert platform, suffered a **cyber attack** leading to a **data breach** where **names, addresses, email addresses, phone numbers, and passwords** of users (including 88,000 landline and 130,000 cell phone subscribers) were potentially leaked. The attack also **disabled the entire CodeRED system nationwide**, preventing critical emergency alerts (e.g., wildfires, active shooters) from being sent to residents. Law enforcement agencies, including **Douglas County Sheriff’s Office**, terminated contracts due to the **lack of notification** about the outage and breach, forcing them to rely on **social media and door-to-door alerts** as temporary measures. The breach exposed users to **credential stuffing attacks**, with experts warning of potential financial fraud if passwords were reused. Crisis24 confirmed the attack was **contained to the legacy CodeRED environment** but admitted the incident disrupted **public safety communications** across multiple states, raising concerns over the **reliability of emergency notification systems**.
CodeRED (Emergency Notification System)
Cyber Attack
Rankiteo Explanation
Attack threatening the economy of geographical region
Description: The town of Surf City reported that **CodeRED**, an emergency notification system used to alert residents during critical events, suffered a **cyberattack-induced service outage**. The attack disrupted the platform’s software, temporarily impairing its ability to function normally. While Surf City maintained backup methods to issue emergency alerts, the incident exposed vulnerabilities in a system relied upon for public safety communications. CodeRED announced a new platform launch to restore full service, but the breach necessitated password resets for users due to potential credential exposure. The attack did not result in direct data theft or financial loss but **compromised the integrity of a critical public warning infrastructure**, risking delayed or failed emergency notifications. The incident highlights the broader threat to **municipal and governmental services** that depend on third-party digital systems for life-saving communications. No ransom demands or permanent data loss were reported, but the disruption underscored the fragility of cyber-physical safety networks.
OnSolve (CodeRED by Crisis24)
Ransomware
Rankiteo Explanation
Attack limited on finance or reputation
Description: A targeted cyber attack compromised the **CodeRED emergency notification system** in Harrisburg, SD, operated by **OnSolve (Crisis24)**. The incident was contained within the CodeRED environment, but hackers gained access to a server, potentially exposing **user data**—including **names, addresses, email addresses, and phone numbers**—though no highly sensitive information (e.g., financial or medical records) was breached. The primary motive appeared to be **ransom extraction**, though no payment demands were explicitly confirmed. The affected server was promptly isolated, and services were migrated to a new server, with full restoration expected by late November 23 or early November 24. While the attack disrupted emergency alert capabilities (raising concerns ahead of a snowstorm), no broader systemic damage or lateral movement into other city systems occurred. The breach underscored vulnerabilities in third-party notification platforms, though the exposed data was limited to basic contact details used for public alerts.
OnSolve (Crisis24)
Ransomware
Rankiteo Explanation
Attack threatening the economy of geographical region
Description: The INC ransomware-as-a-service gang executed a cyberattack on **OnSolve’s CodeRED platform**, a critical emergency notification system used by U.S. state/local governments, police, and fire departments. The intrusion led to **data theft**—including users' **names, addresses, phone numbers, emails, and passwords**—though no misuse has been detected yet. The attackers **encrypted data on November 10** after initial access on **November 1** and later **offered the stolen data for sale** following OnSolve’s refusal to pay the ransom. The disruption **crippled emergency alert systems**, potentially delaying life-saving communications for public safety agencies. INC Ransomware, active for over two years, has previously targeted high-profile victims like **Xerox, Ahold Delhaize, and Scotland’s NHS**, reinforcing its reputation as a persistent and damaging threat actor.
OnSolve (CodeRED)
Ransomware
Rankiteo Explanation
Attack threatening the economy of geographical region
Description: A cyberattack on **OnSolve’s CodeRED**—a cloud-based emergency alert system used by U.S. state/local governments, police, and fire agencies—disrupted critical notification services, preventing geo-targeted warnings (calls, texts, emails) during emergencies. The **INC Ransom** group claimed responsibility, encrypting files on **November 10, 2025**, after gaining access on **November 1**. The attack compromised user data, including **names, addresses, email addresses, phone numbers, and passwords**, though no financial data was exposed. While the stolen data (e.g., .csv files from databases) was not yet leaked online, the group threatened to sell it after OnSolve refused a **$100,000 ransom**. The incident forced the decommissioning of the old CodeRED platform, with customers migrated to a new, audited system. The outage directly impacted public safety communications, risking delayed emergency responses for agencies relying on the service. OnSolve failed to report the breach to authorities initially, exacerbating reputational and operational damage.
OnSolve (Crisis24)
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: OnSolve’s legacy **CodeRED** alerting platform—a cloud-based emergency notification system used by over **10,000 communities**—was breached by the **INC Ransom** cybercriminal group. The attack, confirmed on **November 1 (breach) and November 10 (file encryption)**, exposed **names, addresses, emails, phone numbers, and passwords** of users tied to the platform. While no ransom was paid, the compromised data was **published online**, forcing multiple jurisdictions (e.g., **South Carolina, Michigan, Colorado**) to **decommission the platform**, disrupting critical public safety alerts (e.g., weather emergencies, missing-person notices). Authorities warned users to **change passwords**—especially if reused elsewhere—to mitigate risks of further account takeovers. The incident underscores **third-party supply-chain vulnerabilities** in government-supported services, as ransomware groups increasingly target vendors handling sensitive public infrastructure. OnSolve is migrating affected customers to a **new CodeRED platform** while investigations continue.
OnSolve (Crisis24)
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: OnSolve, the provider of the **CodeRED** mass-notification platform (used by governments, police, and emergency services), suffered a **ransomware attack by INC Ransom**, forcing it to decommission its legacy **CodeRED** environment and migrate to a newer version. The attack resulted in the **permanent loss of recent customer accounts and data** due to outdated backups (over six months old). Sensitive user data—including **names, addresses, emails, phone numbers, and passwords**—was exfiltrated, with high risk of leakage. The **Douglas County Sheriff’s Office and 911 Board terminated their contract with CodeRED**, citing **citizen privacy concerns**. The FBI was notified, and users were urged to change passwords across other platforms to mitigate risks. The attack disrupted critical emergency communication services, exposing vulnerabilities in public safety infrastructure.
OnSolve (Crisis24)
Ransomware
Rankiteo Explanation
Attack threatening the economy of geographical region
Description: The INC ransomware-as-a-service (RaaS) gang executed a cyberattack on **OnSolve’s CodeRED platform**, a critical emergency notification system used by **multiple U.S. state and local governments, police, and fire departments**. The disruption compromised the ability of these agencies to issue timely alerts during emergencies, potentially delaying response times for public safety incidents, natural disasters, or law enforcement operations. The attack directly targeted a **risk management firm (Crisis24)** responsible for maintaining the platform, exposing vulnerabilities in third-party infrastructure relied upon by governmental and emergency services.Given the platform’s role in coordinating **vital public safety communications**, the outage posed risks to community resilience, particularly in scenarios requiring rapid dissemination of warnings (e.g., severe weather, active threats, or evacuation orders). While the article does not confirm data exfiltration, the **operational paralysis of emergency systems** aligns with high-stakes cyber disruptions that undermine trust in critical infrastructure. The involvement of a **ransomware gang** further suggests potential demands for payment, though the primary impact stems from the **systemic failure of a service essential to public welfare and regional stability**.
OnSolve (CodeRED by Crisis24)
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: A ransomware attack by the **Inc Ransom** group targeted OnSolve’s **CodeRED** emergency alert system, a third-party platform used by US cities, counties, and law enforcement for critical public safety notifications (e.g., floods, fires, chemical spills, bomb threats). The attack disrupted emergency alert capabilities across multiple states, including Massachusetts, Colorado, Texas, and Florida, leaving agencies unable to send time-sensitive warnings. Cybercriminals exfiltrated user data—names, emails, physical addresses, phone numbers, and legacy platform passwords—before encrypting files. While some stolen data was later published for sale, negotiations failed after OnSolve offered only **$100,000** in ransom. The incident prompted contract cancellations and migrations to a new CodeRED platform, as the legacy system was discontinued. The outage posed risks to public safety communication, though the national **Emergency Alert System (EAS)** remained unaffected.
Crisis24 (OnSolve CodeRED)
Ransomware
Rankiteo Explanation
Attack threatening the economy of geographical region
Description: Crisis24’s **OnSolve CodeRED**, a widely used emergency notification system for law enforcement and municipalities, was **permanently shut down** following a **targeted ransomware attack** by an organized cybercriminal group (claimed by **INC ransomware**). The attack **compromised the CodeRED environment**, leading to the **theft and leak of personally identifiable information (PII)**—including names, addresses, emails, phone numbers, and passwords—of users subscribed to the service. While the breach was **contained within the legacy system**, dozens of agencies lost access to emergency alerts for **two weeks**, disrupting public safety communications. Crisis24 decommissioned the platform, accelerated migration to a new system, and initiated security audits. The incident forced some customers, like the **Douglas County Sheriff’s Office (Colorado)**, to **terminate contracts**, citing loss of trust. The **government’s Emergency Alert System remained unaffected**, but the attack exposed critical vulnerabilities in public warning infrastructure, raising concerns over **data security and operational resilience** in emergency services.
ECN Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for ECN
Incidents vs IT Services and IT Consulting Industry Average (This Year)
Emergency Communications Network has 2081.82% more incidents than the average of same-industry companies with at least one recorded incident.
Incidents vs All-Companies Average (This Year)
Emergency Communications Network has 1746.15% more incidents than the average of all companies with at least one recorded incident.
Incident Types ECN vs IT Services and IT Consulting Industry Avg (This Year)
Emergency Communications Network reported 12 incidents this year: 4 cyber attacks, 8 ransomware, 0 vulnerabilities, 0 data breaches, compared to industry peers with at least 1 incident.
Incident History — ECN (X = Date, Y = Severity)
ECN cyber incidents detection timeline including parent company and subsidiaries
ECN Company Subsidiaries
Effective June 5, 2017 Emergency Communications Network (ECN) has changed to OnSolve. Combining ECN, MIR3 and SendWordNow, establishes OnSolve as the market leader in cloud-based communication and collaboration tools for delivering critical notifications, enhancing business continuity, and improving enterprise-wide productivity. Please follow OnSolve for all future updates and posts and visit us online at www.onsolve.com to learn more. --------- Emergency Communications Network (ECN) is the leading provider of Software as a Service (SaaS) technology designed to help public and private sector enterprises keep employees, citizens, and stakeholders better informed and safe across the United States and Canada. Our sophisticated infrastructure allows our clients – many of whom have been with us for more than a decade – to deliver thousands of critical messages within minutes via voice, text, email, social media, and mobile app alerts. ECN has invested millions of dollars in its infrastructure to ensure clients have access to our services 24/7/365, without fail, from anywhere. ECN Launcher allows authorized personnel to initiate messages from anywhere via smartphones or tablets, giving agencies, departments and businesses the power to communicate to the right people, at the right time, regardless of the situation. Our flagship product CodeRED®, enables local government and public safety officials to communicate time-sensitive, personalized messages using a multimodal approach to its residents and staff. Our SmartNotice® solution serves as a business continuity tool to disseminate critical information to employees or other stakeholders in an easy, reliable, and affordable manner. ECN is headquartered in Ormond Beach, Florida and remains committed to its mission to help alert, inform and affect lives.
Loading...
ECN Similar Companies
CenturyLink
CenturyLink (NYSE: CTL) is a technology leader delivering hybrid networking, cloud connectivity, and security solutions to customers around the world. Through its extensive global fiber network, CenturyLink provides secure and reliable services to meet the growing digital demands of businesses and c
Indra (www.indracompany.com) is one of the leading global defence, aerospace and technology companies, and a world leader in digital transformation and information technologies in Spain and Latin America through its subsidiary, Minsait. Its business model is based on a comprehensive range of proprie
Amadeus
We make the experience of travel better for everyone, everywhere by inspiring innovation, partnerships and responsibility to people, places and planet. Our technology powers the travel and tourism industry. We inspire more connected ways of thinking, centered around the traveler. Our platform c
We are an AI-led, platform-driven Digital Engineering and Enterprise Modernization partner, combining deep technical expertise and industry expertise to help our clients anticipate what’s next. Our offerings and proven solutions create a unique competitive advantage for our clients by giving them th
Minsait
We are one of the world's leading consultancies in technological services for companies and the public sector. With headquarters in Spain and presence in more than 100 countries, we combine experience in AI, data, cloud and cybersecurity to help companies and organizations generate a positive impact
For over 70 years, Iron Mountain Incorporated (NYSE: IRM) has been your strategic partner to care for your information and assets. A global leader in storage and information management services and trusted by more than 225,000 organizations around the world, including 95% of the Fortune 1000, we pro
NTT DATA North America
NTT DATA, Inc. is a trusted global innovator of business and technology services. We're committed to helping clients innovate, optimize and transform for long-term success. Our R&D investments help organizations and society move confidently and sustainably into the digital future. As a Global Top Em
Orange Business
At Orange Business, our ambition is to become the leading european Network and Digital Integrator by leveraging our proven expertise in next-generation connectivity solutions, the cloud and cybersecurity. Our 30,000 women and men are present in 65 countries, where every voice counts. Together, we a
SoftwareOne
SoftwareOne is a leading global software and cloud solutions provider that is redefining how companies build, buy and manage everything in the cloud. By helping clients to migrate and modernize their workloads and applications – and in parallel, to navigate and optimize the resulting software and cl
.png)
ECN CyberSecurity News
November 07, 2025 08:00 AM
How El Paso, Texas, Built a Smarter Emergency Network
By modernizing its 911 system and embracing automation, El Paso is delivering faster, more efficient emergency services with tools like a...
October 27, 2025 07:00 AM
Florida Emergency Communications Board declines to act on 911 fee increase despite calls from counties
Members of the Florida Emergency Communications Board (ECB) heard urgent pleas from county 911 coordinators and law enforcement officials on...
October 08, 2025 07:00 AM
New DHS lab aims to ensure next-gen 911 systems are compatible
DHS's Science and Technology directorate works to ensure emergency communications technology is compatible across different agencies.
October 02, 2025 07:00 AM
Resilient Networks; Disruptions to Communications
China poses an unprecedented cyber threat to the United States, having evolved from a clear follower into a near-peer adversary capable of...
October 01, 2025 07:00 AM
CISA looks to bring data advances to emergency communications
The Cybersecurity and Infrastructure Security Agency's program to secure priority access for emergency communications is moving beyond voice...
October 01, 2025 07:00 AM
200,000 More SIM Cards Found Linked to Secret Telecom Network in NYC
The discovery adds to the 100000 SIM cards and 300 servers discovered last week that could have been used to shut down communications in...
September 24, 2025 07:00 AM
Secret Service Stops Major NYC Cell Network Attack
In September 2025, the US Secret Service announced the successful dismantling of a sprawling network of SIM servers and SIM cards across the...
September 23, 2025 07:00 AM
U.S. Secret Service disrupts telecom network that threatened NYC during U.N. General Assembly
Early analysis shows the network was used for communication between foreign governments and individuals known to U.S. law enforcement.
September 23, 2025 07:00 AM
A plot could have caused cell phone chaos. It's part of a troubling trend.
The discovery of a vast telecommunications network that authorities say was capable of wiping out cellular communications in the nation's...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
ECN CyberSecurity History Information
Official Website of Emergency Communications Network
The official website of Emergency Communications Network is http://www.onsolve.com.
Emergency Communications Network’s AI-Generated Cybersecurity Score
According to Rankiteo, Emergency Communications Network’s AI-generated cybersecurity score is 100, reflecting their Critical security posture.
How many security badges does Emergency Communications Network’ have ?
According to Rankiteo, Emergency Communications Network currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does Emergency Communications Network have SOC 2 Type 1 certification ?
According to Rankiteo, Emergency Communications Network is not certified under SOC 2 Type 1.
Does Emergency Communications Network have SOC 2 Type 2 certification ?
According to Rankiteo, Emergency Communications Network does not hold a SOC 2 Type 2 certification.
Does Emergency Communications Network comply with GDPR ?
According to Rankiteo, Emergency Communications Network is not listed as GDPR compliant.
Does Emergency Communications Network have PCI DSS certification ?
According to Rankiteo, Emergency Communications Network does not currently maintain PCI DSS compliance.
Does Emergency Communications Network comply with HIPAA ?
According to Rankiteo, Emergency Communications Network is not compliant with HIPAA regulations.
Does Emergency Communications Network have ISO 27001 certification ?
According to Rankiteo,Emergency Communications Network is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Emergency Communications Network
Emergency Communications Network operates primarily in the IT Services and IT Consulting industry.
Number of Employees at Emergency Communications Network
Emergency Communications Network employs approximately 56 people worldwide.
Subsidiaries Owned by Emergency Communications Network
Emergency Communications Network presently has no subsidiaries across any sectors.
Emergency Communications Network’s LinkedIn Followers
Emergency Communications Network’s official LinkedIn profile has approximately 1,019 followers.
NAICS Classification of Emergency Communications Network
Emergency Communications Network is classified under the NAICS code 5415, which corresponds to Computer Systems Design and Related Services.
Emergency Communications Network’s Presence on Crunchbase
No, Emergency Communications Network does not have a profile on Crunchbase.
Emergency Communications Network’s Presence on LinkedIn
Yes, Emergency Communications Network maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/emergency-communications-network-llc.
Cybersecurity Incidents Involving Emergency Communications Network
As of November 27, 2025, Rankiteo reports that Emergency Communications Network has experienced 12 cybersecurity incidents.
Number of Peer and Competitor Companies
Emergency Communications Network has an estimated 36,263 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Emergency Communications Network ?
Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack and Ransomware.
How does Emergency Communications Network detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with discontinuation of codered system, and remediation measures with evaluation of alternative alert providers, and recovery measures with door-to-door notifications, recovery measures with social media alerts, recovery measures with potential new system adoption within 1–2 weeks, and communication strategy with public disclosure, communication strategy with advisories to residents (credit bureau checks), communication strategy with media statements, and incident response plan activated with yes (forensic analysis conducted; platform decommissioned), and law enforcement notified with delayed (agencies learned of outage only when alerts failed; no proactive notification), and containment measures with decommissioning of legacy onsolve codered platform, containment measures with isolation of affected environment, and remediation measures with accelerated rollout of 'codered by crisis24' platform, and communication strategy with limited (criticized by agencies for lack of transparency), communication strategy with public statement via media (denver7), communication strategy with advisories to users about password reuse risks, and and third party assistance with external cybersecurity experts, and containment measures with decommissioning of onsolve codered platform, containment measures with isolation of the incident to the third-party vendor's system, and remediation measures with launch of new codered platform on a non-compromised, separate environment, remediation measures with comprehensive security audit, remediation measures with penetration testing and hardening by external experts, and recovery measures with transition to new codered platform by november 28, 2023, recovery measures with use of alternative communication channels (local media, county website, social media) in the interim, and communication strategy with public disclosure of the incident, communication strategy with faqs provided by codered by crisis24, communication strategy with advisories for users to change passwords, communication strategy with collaboration with craven county emergency services for transparency, and remediation measures with transition to a new codered platform (legacy platform discontinued), and communication strategy with limited; no public statement from crisis24/onsolve. local governments issued notifications to residents., and and third party assistance with external security experts (for penetration testing and hardening), and containment measures with decommissioning of compromised codered platform, containment measures with migration to new secure platform, and remediation measures with full security audit, remediation measures with penetration testing, remediation measures with system hardening, remediation measures with new platform built in uncompromised environment, and recovery measures with migration of all customers to new platform, and communication strategy with public notification by city of university park, communication strategy with advisory to change reused passwords, communication strategy with transparency about potential future data leaks, and and and containment measures with decommissioned legacy codered platform, containment measures with accelerated rollout of new codered by crisis24 platform, and remediation measures with password reset advisory for users, remediation measures with migration to new platform, and recovery measures with transferring all customers to new codered by crisis24 platform, and communication strategy with emails to customers, communication strategy with social media and web announcements by affected jurisdictions (e.g., douglas county sheriff, city of weston), communication strategy with public disclosure via bleeping computer, and and law enforcement notified with fbi, and containment measures with sunsetting legacy codered platform, containment measures with migration to new version, and remediation measures with rebuilding from outdated backups, and communication strategy with customer notification, communication strategy with password reset advisory, and communication strategy with public disclosure of breach; emphasis on no observed misuse of stolen data, and and containment measures with maintained ability to send critical notifications despite outage, and remediation measures with launch of new notification platform on 2025-11-28, and recovery measures with full service restoration planned for 2025-11-28, and communication strategy with public announcement via facebook post, communication strategy with advisory for users to change passwords, communication strategy with media coverage (wect news report), and incident response plan activated with yes (forensic analysis, security audit, third-party penetration testing), and third party assistance with yes (penetration testing, security audit), and law enforcement notified with yes, and containment measures with isolation of legacy codered environment; decommissioning of affected system, and remediation measures with accelerated rollout of new codered platform, remediation measures with migration of all customers to new system, remediation measures with security audit and penetration testing, and recovery measures with transition to new platform; customer notifications and advisories, and communication strategy with public statements, customer notifications, and advisories to affected users (e.g., password change recommendations), and network segmentation with yes (legacy system isolated from new platform), and incident response plan activated with yes (coordination between harrisburg and crisis24), and third party assistance with crisis24 (provider of codered system), and containment measures with prompt closure of the affected server, and remediation measures with migration to another crisis24 server, and recovery measures with restoration of alerting and public notification capabilities by late november 2024, and communication strategy with public disclosure via dakota news now, communication strategy with letter from crisis24 published on the city website with faqs and contact email, communication strategy with alternative communication channels (news stations) for snow emergencies..
Incident Details
Can you provide details on each incident ?
Title: Cyberattack and Data Breach on Douglas County Sheriff’s Office CodeRED Emergency Alert System
Description: The Douglas County Sheriff’s Office discontinued use of its CodeRED emergency alert system after discovering a cyberattack and data breach. The breach resulted in the loss of customers’ personal information, though the data has not been published online. The incident affected hundreds of agencies nationwide, including multiple Colorado counties. The sheriff’s office is transitioning to alternative alert methods (e.g., door-to-door notifications, social media) while evaluating new providers.
Date Detected: 2023-11-21
Date Publicly Disclosed: 2023-11-27
Type: Cyberattack
Title: Cyber Attack on CodeRED Emergency Alert System Disrupts Services Across Colorado and Nationwide
Description: CodeRED, an emergency alert system owned by Crisis24 (OnSolve), suffered a cyber attack in early [Month, Year not specified]. The breach exposed user data (names, addresses, emails, phone numbers, passwords) and caused system outages, preventing law enforcement agencies from sending critical alerts. Multiple Colorado agencies (e.g., Douglas County, Thornton, Arapahoe County, Aurora) terminated or reevaluated contracts due to the incident. Crisis24 confirmed the attack was contained to the legacy OnSolve CodeRED platform, with data published online by an organized cybercriminal group. The company decommissioned the affected platform and accelerated the rollout of a new system, 'CodeRED by Crisis24'.
Type: Data Breach
Threat Actor: Organized cybercriminal group
Motivation: Financial Gain (credential stuffing/aggregation)Disruption of Services
Title: Cybersecurity Attack on OnSolve CodeRED Emergency Alert System
Description: OnSolve CodeRED, a platform used by Craven County to send public emergency notifications and alerts, was targeted in a cybersecurity attack in November. User data, including names, addresses, email addresses, phone numbers, and passwords, was removed from the system. While there is no current indication that the data has been published online, the threat of a future leak remains. The OnSolve CodeRED system was decommissioned nationwide following the incident, which was isolated to the third-party vendor's system and did not affect Craven County's systems. A new platform, which has undergone a comprehensive security audit, is expected to be operational by November 28.
Date Detected: November 2023
Date Publicly Disclosed: November 2023
Type: Data Breach
Threat Actor: Organized cybercriminal group
Title: Ransomware Attack on OnSolve CodeRED Emergency Alert System
Description: A ransomware attack targeting the OnSolve CodeRED emergency alert system, provided by Crisis24, has disrupted emergency notifications across multiple U.S. states. The attack resulted in a data breach exposing user data, including names, email addresses, physical addresses, phone numbers, and passwords from a legacy platform. The Inc Ransom group claimed responsibility, stating they accessed systems on November 1, deployed ransomware on November 10, and listed the incident on their leak site on November 22 after failed ransom negotiations (vendor offered $100,000). Some stolen data was later published and put up for sale. The incident did not affect the national Emergency Alert System (EAS), but local governments in at least 14 states reported disruptions. Some customers are canceling contracts or transitioning to a new CodeRED platform.
Date Detected: 2023-11-01
Type: ransomware
Threat Actor: Inc Ransom
Motivation: financial gain
Title: Cyberattack on OnSolve CodeRED Disrupts Emergency Alert Services
Description: A cyberattack on the OnSolve CodeRED alert platform disrupted emergency notification services used by U.S. state and local governments, police, and fire agencies. The INC Ransom group claimed responsibility, potentially compromising user data including names, addresses, email addresses, phone numbers, and passwords. The City of University Park, Texas, reported the incident, noting that while no financial data was exposed, reused passwords should be changed. OnSolve is migrating customers to a new, secured platform after decommissioning the compromised system.
Date Detected: 2025-11-01
Date Publicly Disclosed: 2025-11-26
Type: cyberattack
Threat Actor: INC Ransom group
Motivation: financial gaindata theftreputation damage
Title: OnSolve CodeRED Legacy Platform Data Breach and Ransomware Attack
Description: Public safety agencies across the U.S. took OnSolve’s legacy CodeRED alerting platform offline after a data breach tied to a ransomware attack by the INC Ransom gang. The breach exposed user data, including names, addresses, emails, phone numbers, and passwords. The platform was decommissioned, and customers were advised to change passwords, especially if reused elsewhere. Law enforcement was notified, and an investigation is ongoing. The company is migrating users to a new platform, CodeRED by Crisis24.
Date Publicly Disclosed: 2023-11-15
Type: Data Breach
Threat Actor: INC Ransom gang
Motivation: Financial (ransomware)
Title: OnSolve’s legacy CodeRED platform hit by cyberattack claimed by INC Ransom
Description: OnSolve, a cloud-based critical-event and mass-notification platform, suffered a highly disruptive cyberattack that forced it to sunset its legacy CodeRED environment and move to a new version. The attack, claimed by INC Ransom, resulted in the loss of sensitive data, recent accounts, and a business customer (Douglas County Sheriff’s Office and 911 Board). Crisis24 (parent company) had to rebuild from outdated backups (>6 months old), leading to permanent data loss. The compromised dataset may include user contact information (name, address, email, phone numbers, passwords). The FBI was notified, and INC Ransom posted screenshots of customer data on its Tor leak site.
Type: cyberattack
Threat Actor: INC Ransom
Motivation: financial gaindata theft
Title: Cyberattack on Crisis24's OnSolve CodeRED Platform by INC Ransomware Gang
Description: Multiple U.S. state and local governments, police, and fire departments experienced disruptions in their emergency notification systems due to a cyberattack on Crisis24's OnSolve CodeRED platform. The INC ransomware-as-a-service gang claimed responsibility, stealing user data including names, addresses, phone numbers, email addresses, and passwords. The attack occurred on November 1, with data encryption on November 10. The stolen data was offered for sale after Crisis24 reportedly refused to pay the ransom.
Date Publicly Disclosed: 2023-11-01
Type: cyberattack
Threat Actor: INC ransomware-as-a-service gang
Motivation: financial gaindata theft
Title: Cyberattack on CodeRED Emergency Notification System in Surf City, N.C.
Description: The town of Surf City reported a cyberattack affecting the CodeRED emergency notification system, causing a service outage. CodeRED is used to send alerts and updates to residents during emergencies. While the system experienced an outage, Surf City maintained the ability to issue critical notifications. A new notification platform is set to launch on November 28, restoring full service. Users are advised to change passwords similar to their CodeRED credentials.
Date Resolved: 2025-11-28
Type: Cyberattack (Service Disruption)
Title: Ransomware Attack on OnSolve CodeRED Emergency Notification System
Description: OnSolve CodeRED, a voluntary, opt-in emergency notification system used by law enforcement agencies and municipalities, was permanently shut down following a ransomware attack. The attack, attributed to the INC ransomware group, resulted in data theft, including personally identifiable information (PII) of users. The legacy system was decommissioned, and customers were migrated to a new platform. Dozens of agencies were left without access to emergency notifications for approximately two weeks.
Date Detected: Early [Month, Year] (exact date not specified)
Date Publicly Disclosed: [Day, Month, Year] (Wednesday statement, exact date not specified)
Type: Ransomware Attack / Data Breach
Threat Actor: INC Ransomware (organized cybercriminal group)
Motivation: Financial (ransomware) / Data Theft
Title: Cyber Attack on Harrisburg's CodeRED Emergency Notification System by Crisis24
Description: A targeted cyber attack compromised the OnSolve CodeRED emergency notification system in Harrisburg, South Dakota. The attack was contained within the CodeRED environment and primarily aimed at extracting ransom money. Limited user data (names, addresses, email addresses, and phone numbers) may have been exposed, but the server was promptly closed. The system is expected to be restored by late Wednesday or early Thanksgiving Day. The city coordinated with Crisis24 and prepared alternative communication methods (e.g., news stations) for snow emergencies during the outage.
Date Resolved: Expected by late November 2024 (Wednesday night or early Thanksgiving Day)
Type: Cyber Attack
Motivation: Financial (ransom money)
Title: Ransomware Attack on Crisis24's OnSolve CodeRED Platform Disrupts U.S. Emergency Notification Systems
Description: Multiple U.S. state and local governments, as well as police and fire departments, experienced disruptions in their emergency notification systems due to a cyberattack on Crisis24's OnSolve CodeRED platform. The INC ransomware-as-a-service (RaaS) gang claimed responsibility for the attack.
Date Detected: 2025-11-26
Date Publicly Disclosed: 2025-11-26
Type: cyberattack
Threat Actor: INC ransomware-as-a-service (RaaS) gang
Motivation: financial gaindisruption
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Ransomware.
Impact of the Incidents
What was the impact of each incident ?
Incident : Cyberattack EME1521815112525
Systems Affected: CodeRED emergency alert system
Downtime: 2023-11-07 (approx. initial outage) to 2023-11-21 (discontinuation)
Operational Impact: Loss of emergency alert capabilities; reliance on manual methods (door-to-door, social media)
Brand Reputation Impact: Loss of trust in CodeRED system; transition to alternative providers
Identity Theft Risk: Potential (residents advised to contact credit bureaus)
Incident : Data Breach EME0664306112525
Data Compromised: Names, Addresses, Email addresses, Phone numbers, Passwords (hashed/plaintext unclear)
Systems Affected: CodeRED emergency alert platform (legacy OnSolve environment)
Downtime: Nationwide outage (duration unspecified; at least two weeks by disclosure time)
Operational Impact: Inability to send emergency alerts (e.g., wildfires, active shooters, prescribed burns)Manual workarounds required (social media, door-to-door notifications)Contract terminations/reevaluations by multiple agencies
Customer Complaints: High (implied by public statements from law enforcement and media coverage)
Brand Reputation Impact: Severe (loss of trust from public safety agencies and residents; public criticism for delayed disclosure)
Identity Theft Risk: High (credential reuse warnings issued; potential for aggregation with other breached data)
Payment Information Risk: Indirect (warning issued about bad actors targeting banks/credit cards using leaked credentials)
Incident : Data Breach EME2592825112525
Data Compromised: Names, Addresses, Email addresses, Phone numbers, Passwords
Systems Affected: OnSolve CodeRED platform
Downtime: System decommissioned; new platform expected by November 28, 2023
Operational Impact: Emergency alert system temporarily unavailable; county using alternative communication methods (local media, county website, social media)
Brand Reputation Impact: Potential reputational damage due to data breach and system decommissioning
Identity Theft Risk: Low (no evidence of identity theft or fraud, but risk remains due to exposed data)
Incident : ransomware EME5640356112625
Data Compromised: Names, Email addresses, Physical addresses, Phone numbers, User profile passwords (legacy platform)
Systems Affected: OnSolve CodeRED emergency alert system (legacy platform)
Downtime: Ongoing disruptions reported as of late November 2023 (exact duration unclear)
Operational Impact: Inability to send emergency notifications for public safety events (e.g., floods, gas leaks, fires, missing persons, bomb threats) across multiple U.S. states
Customer Complaints: Reports of contract cancellations and transitions to new platforms by local government agencies
Brand Reputation Impact: Significant; loss of trust from municipal customers, public scrutiny over legacy system vulnerabilities
Identity Theft Risk: High (exposed PII including names, addresses, and passwords)
Incident : cyberattack EME3841238112625
Systems Affected: OnSolve CodeRED alert platform (previous version)
Downtime: True
Operational Impact: Disruption of emergency alert services for U.S. state, local, police, and fire agencies
Brand Reputation Impact: Potential damage due to data breach and service disruption
Identity Theft Risk: High (due to compromised PII: names, addresses, emails, phone numbers, passwords)
Payment Information Risk: None (no financial data collected by CodeRED)
Incident : Data Breach EME1592315112625
Data Compromised: Names, Addresses, Emails, Phone numbers, Passwords
Systems Affected: Legacy CodeRED alerting platform
Downtime: Platform taken offline in multiple jurisdictions (e.g., South Carolina, Michigan, Colorado)
Operational Impact: Disruption of public safety alerts (weather emergencies, boil-water notices, missing-person alerts, etc.)
Brand Reputation Impact: High (public safety agencies and 10,000+ communities affected; loss of trust in alerting system)
Identity Theft Risk: High (due to exposed PII and password reuse warnings)
Incident : cyberattack EME1392513112625
Data Compromised: User contact information (name, address, email, phone numbers), Passwords, Sensitive organizational data
Systems Affected: legacy CodeRED platform
Downtime: True
Operational Impact: service rebuild from outdated backups (>6 months old)permanent loss of recent accounts/datacustomer (Douglas County) termination
Customer Complaints: True
Identity Theft Risk: True
Incident : cyberattack EME2692726112625
Data Compromised: Names, Addresses, Phone numbers, Email addresses, Passwords
Systems Affected: OnSolve CodeRED platform
Operational Impact: Disruption of emergency notification systems for U.S. state/local governments, police, and fire departments
Brand Reputation Impact: Potential reputational damage due to data breach and service disruption
Identity Theft Risk: High (due to exposure of PII)
Incident : Cyberattack (Service Disruption) EME2692826112625
Systems Affected: CodeRED emergency notification system
Downtime: {'start': None, 'end': '2025-11-28', 'duration': None}
Operational Impact: Partial disruption of emergency notification services (non-critical notifications may have been delayed, but critical alerts remained functional)
Brand Reputation Impact: Potential erosion of trust in emergency notification reliability; proactive communication mitigated some risk
Incident : Ransomware Attack / Data Breach EME5262152112725
Data Compromised: Names, Addresses, Email addresses, Phone numbers, Passwords
Systems Affected: OnSolve CodeRED legacy platform
Downtime: Approximately two weeks (for dozens of agencies)
Operational Impact: Loss of emergency notification capabilities for affected agencies; permanent decommissioning of legacy CodeRED platform
Customer Complaints: Reported (e.g., Douglas County Sheriff’s Office terminated contract)
Brand Reputation Impact: High (permanent shutdown of legacy system; public disclosure of PII breach)
Identity Theft Risk: High (PII leaked, including passwords reused across accounts)
Incident : Cyber Attack EME5462554112725
Data Compromised: Names, Addresses, Email addresses, Phone numbers
Systems Affected: OnSolve CodeRED emergency notification system (single server)
Downtime: From detection until late November 2024 (Wednesday night or early Thanksgiving Day)
Operational Impact: Temporary loss of emergency notification capabilities; city prepared alternative communication channels (e.g., news stations) for snow emergencies.
Brand Reputation Impact: Potential concern due to breach of emergency system, but limited data exposure mitigated severe reputational damage.
Identity Theft Risk: Low (limited to names, addresses, emails, and phone numbers)
Incident : cyberattack EME2962429112725
Systems Affected: OnSolve CodeRED emergency notification platform
Operational Impact: disruption of emergency notifications for U.S. state/local governments, police, and fire departments
Brand Reputation Impact: potential loss of trust in emergency notification systems
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personally Identifiable Information (Pii), , Pii (Personally Identifiable Information), Authentication Credentials, , Personal Identifiable Information (Pii), , Personally Identifiable Information (Pii), Authentication Credentials, , Personally Identifiable Information (Pii), , Personally Identifiable Information (Pii), Authentication Credentials, , Contact Information (Name, Address, Email, Phone), Passwords, User Profiles, , Personally Identifiable Information (Pii), Authentication Credentials, , Personally Identifiable Information (Pii), , Personally Identifiable Information (Pii) and .
Which entities were affected by each incident ?
Incident : Cyberattack EME1521815112525
Entity Name: Douglas County Sheriff’s Office
Entity Type: Government Agency (Law Enforcement)
Industry: Public Safety
Location: Douglas County, Colorado, USA
Customers Affected: Unknown (residents using CodeRED)
Incident : Cyberattack EME1521815112525
Entity Name: Weld County Sheriff’s Office
Entity Type: Government Agency (Law Enforcement)
Industry: Public Safety
Location: Weld County, Colorado, USA
Customers Affected: Unknown
Incident : Cyberattack EME1521815112525
Entity Name: Park County Sheriff’s Office
Entity Type: Government Agency (Law Enforcement)
Industry: Public Safety
Location: Park County, Colorado, USA
Customers Affected: Unknown
Incident : Cyberattack EME1521815112525
Entity Name: CodeRED (OnSolve)
Entity Type: Private Company
Industry: Emergency Notification Services
Location: USA (nationwide)
Customers Affected: Hundreds of agencies
Incident : Data Breach EME0664306112525
Entity Name: Douglas County Sheriff's Office (DCSO)
Entity Type: Law Enforcement Agency
Industry: Public Safety
Location: Douglas County, Colorado, USA
Customers Affected: 88,000 landline users + 130,000 cell phone users (DCSO subscribers)
Incident : Data Breach EME0664306112525
Entity Name: Thornton Police Department
Entity Type: Law Enforcement Agency
Industry: Public Safety
Location: Thornton, Colorado, USA
Incident : Data Breach EME0664306112525
Entity Name: Arapahoe County Sheriff's Office
Entity Type: Law Enforcement Agency
Industry: Public Safety
Location: Arapahoe County, Colorado, USA
Incident : Data Breach EME0664306112525
Entity Name: City of Aurora
Entity Type: Municipal Government
Industry: Public Safety
Location: Aurora, Colorado, USA
Incident : Data Breach EME0664306112525
Entity Name: State of Colorado (multiple agencies)
Entity Type: State Government
Industry: Public Safety
Location: Colorado, USA
Incident : Data Breach EME0664306112525
Entity Name: Nationwide CodeRED Users
Entity Type: General Public
Location: USA
Incident : Data Breach EME2592825112525
Entity Name: Craven County
Entity Type: Local Government
Industry: Public Administration
Location: North Carolina, USA
Customers Affected: Users registered for OnSolve CodeRED accounts (exact number unspecified)
Incident : Data Breach EME2592825112525
Entity Name: OnSolve (CodeRED by Crisis24)
Entity Type: Private Company (Third-Party Vendor)
Industry: Emergency Notification Services
Customers Affected: Nationwide users of OnSolve CodeRED platform
Incident : ransomware EME5640356112625
Entity Name: OnSolve (Crisis24)
Entity Type: private company
Industry: emergency notification services
Location: United States
Customers Affected: Local governments and law enforcement agencies in at least 14 U.S. states (Massachusetts, Colorado, Texas, Florida, North Carolina, Ohio, Kansas, Georgia, California, Utah, Missouri, Montana, New Mexico, and others)
Incident : ransomware EME5640356112625
Entity Name: Local government agencies (multiple)
Entity Type: cities, counties, law enforcement
Industry: public sector
Location: United States (14+ states)
Customers Affected: Residents relying on CodeRED alerts for emergency notifications
Incident : cyberattack EME3841238112625
Entity Name: OnSolve
Entity Type: private company
Industry: emergency notification services
Location: United States
Incident : cyberattack EME3841238112625
Entity Name: City of University Park, Texas
Entity Type: local government
Industry: public safety
Location: University Park, Texas, USA
Incident : cyberattack EME3841238112625
Entity Name: U.S. state and local governments, police, and fire agencies (users of CodeRED)
Entity Type: government agencies, public safety organizations
Industry: emergency services
Location: United States
Incident : Data Breach EME1592315112625
Entity Name: OnSolve (subsidiary of Crisis24)
Entity Type: Private Company
Industry: Public Safety and Emergency Notification Services
Location: United States
Customers Affected: 10,000+ communities
Incident : Data Breach EME1592315112625
Entity Name: Douglas County Sheriff (Colorado)
Entity Type: Government Agency
Industry: Law Enforcement
Location: Colorado, USA
Incident : Data Breach EME1592315112625
Entity Name: City of Weston (Florida)
Entity Type: Government Agency
Industry: Municipal Services
Location: Florida, USA
Incident : Data Breach EME1592315112625
Entity Name: Jurisdictions in South Carolina, Michigan, and other states
Entity Type: Government Agencies
Industry: Public Safety
Location: USA (Multiple States)
Incident : cyberattack EME1392513112625
Entity Name: OnSolve (Crisis24)
Entity Type: private company
Industry: critical-event management, mass notification, emergency services
Customers Affected: True
Incident : cyberattack EME1392513112625
Entity Name: Douglas County Sheriff’s Office
Entity Type: government agency
Industry: law enforcement
Location: Douglas County, USA
Customers Affected: True
Incident : cyberattack EME1392513112625
Entity Name: Douglas County 911 Board
Entity Type: government agency
Industry: emergency services
Location: Douglas County, USA
Customers Affected: True
Incident : cyberattack EME2692726112625
Entity Name: Crisis24 (OnSolve CodeRED)
Entity Type: private company
Industry: risk management / emergency notification services
Location: United States
Customers Affected: Multiple U.S. state/local governments, police, and fire departments
Incident : cyberattack EME2692726112625
Entity Name: U.S. state and local governments (multiple)
Entity Type: government
Industry: public administration
Location: United States
Incident : cyberattack EME2692726112625
Entity Name: U.S. police and fire departments (multiple)
Entity Type: government
Industry: public safety
Location: United States
Incident : Cyberattack (Service Disruption) EME2692826112625
Entity Name: Town of Surf City, N.C.
Entity Type: Municipal Government
Industry: Public Administration
Location: Surf City, North Carolina, USA
Customers Affected: Residents subscribed to CodeRED alerts (exact number unspecified)
Incident : Cyberattack (Service Disruption) EME2692826112625
Entity Name: CodeRED (OnSolve)
Entity Type: Private Company
Industry: Emergency Communication Services
Incident : Ransomware Attack / Data Breach EME5262152112725
Entity Name: OnSolve CodeRED (by Crisis24)
Entity Type: Private Company
Industry: Emergency Notification Services / Public Safety
Location: USA (nationwide service)
Customers Affected: Dozens of law enforcement agencies and municipalities
Incident : Ransomware Attack / Data Breach EME5262152112725
Entity Name: Douglas County Sheriff’s Office (Colorado)
Entity Type: Government Agency
Industry: Law Enforcement
Location: Colorado, USA
Incident : Cyber Attack EME5462554112725
Entity Name: City of Harrisburg, South Dakota
Entity Type: Municipal Government
Industry: Public Administration
Location: Harrisburg, South Dakota, USA
Customers Affected: Residents subscribed to CodeRED emergency notifications (exact number unspecified)
Incident : Cyber Attack EME5462554112725
Entity Name: Crisis24 (OnSolve)
Entity Type: Private Company
Industry: Risk Management and Emergency Notification Services
Incident : cyberattack EME2962429112725
Entity Name: Crisis24 (OnSolve)
Entity Type: private company
Industry: risk management, emergency notification services
Customers Affected: U.S. state governments, local governments, police departments, fire departments
Incident : cyberattack EME2962429112725
Entity Name: ['Multiple U.S. state governments', 'local governments', 'police departments', 'fire departments']
Entity Type: government, public safety
Industry: public administration, emergency services
Location: United States
Customers Affected: residents relying on emergency notifications
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Cyberattack EME1521815112525
Incident Response Plan Activated: True
Containment Measures: Discontinuation of CodeRED system
Remediation Measures: Evaluation of alternative alert providers
Recovery Measures: Door-to-door notificationsSocial media alertsPotential new system adoption within 1–2 weeks
Communication Strategy: Public disclosureAdvisories to residents (credit bureau checks)Media statements
Incident : Data Breach EME0664306112525
Incident Response Plan Activated: Yes (forensic analysis conducted; platform decommissioned)
Law Enforcement Notified: Delayed (agencies learned of outage only when alerts failed; no proactive notification)
Containment Measures: Decommissioning of legacy OnSolve CodeRED platformIsolation of affected environment
Remediation Measures: Accelerated rollout of 'CodeRED by Crisis24' platform
Communication Strategy: Limited (criticized by agencies for lack of transparency)Public statement via media (Denver7)Advisories to users about password reuse risks
Incident : Data Breach EME2592825112525
Incident Response Plan Activated: True
Third Party Assistance: External Cybersecurity Experts.
Containment Measures: Decommissioning of OnSolve CodeRED platformIsolation of the incident to the third-party vendor's system
Remediation Measures: Launch of new CodeRED platform on a non-compromised, separate environmentComprehensive security auditPenetration testing and hardening by external experts
Recovery Measures: Transition to new CodeRED platform by November 28, 2023Use of alternative communication channels (local media, county website, social media) in the interim
Communication Strategy: Public disclosure of the incidentFAQs provided by CodeRED by Crisis24Advisories for users to change passwordsCollaboration with Craven County Emergency Services for transparency
Incident : ransomware EME5640356112625
Remediation Measures: Transition to a new CodeRED platform (legacy platform discontinued)
Communication Strategy: Limited; no public statement from Crisis24/OnSolve. Local governments issued notifications to residents.
Incident : cyberattack EME3841238112625
Incident Response Plan Activated: True
Third Party Assistance: External Security Experts (For Penetration Testing And Hardening).
Containment Measures: decommissioning of compromised CodeRED platformmigration to new secure platform
Remediation Measures: full security auditpenetration testingsystem hardeningnew platform built in uncompromised environment
Recovery Measures: migration of all customers to new platform
Communication Strategy: public notification by City of University Parkadvisory to change reused passwordstransparency about potential future data leaks
Incident : Data Breach EME1592315112625
Incident Response Plan Activated: True
Containment Measures: Decommissioned legacy CodeRED platformAccelerated rollout of new CodeRED by Crisis24 platform
Remediation Measures: Password reset advisory for usersMigration to new platform
Recovery Measures: Transferring all customers to new CodeRED by Crisis24 platform
Communication Strategy: Emails to customersSocial media and web announcements by affected jurisdictions (e.g., Douglas County Sheriff, City of Weston)Public disclosure via Bleeping Computer
Incident : cyberattack EME1392513112625
Incident Response Plan Activated: True
Law Enforcement Notified: FBI,
Containment Measures: sunsetting legacy CodeRED platformmigration to new version
Remediation Measures: rebuilding from outdated backups
Communication Strategy: customer notificationpassword reset advisory
Incident : cyberattack EME2692726112625
Communication Strategy: Public disclosure of breach; emphasis on no observed misuse of stolen data
Incident : Cyberattack (Service Disruption) EME2692826112625
Incident Response Plan Activated: True
Containment Measures: Maintained ability to send critical notifications despite outage
Remediation Measures: Launch of new notification platform on 2025-11-28
Recovery Measures: Full service restoration planned for 2025-11-28
Communication Strategy: Public announcement via Facebook postAdvisory for users to change passwordsMedia coverage (WECT news report)
Incident : Ransomware Attack / Data Breach EME5262152112725
Incident Response Plan Activated: Yes (forensic analysis, security audit, third-party penetration testing)
Third Party Assistance: Yes (penetration testing, security audit)
Law Enforcement Notified: Yes
Containment Measures: Isolation of legacy CodeRED environment; decommissioning of affected system
Remediation Measures: Accelerated rollout of new CodeRED platformMigration of all customers to new systemSecurity audit and penetration testing
Recovery Measures: Transition to new platform; customer notifications and advisories
Communication Strategy: Public statements, customer notifications, and advisories to affected users (e.g., password change recommendations)
Network Segmentation: Yes (legacy system isolated from new platform)
Incident : Cyber Attack EME5462554112725
Incident Response Plan Activated: Yes (coordination between Harrisburg and Crisis24)
Third Party Assistance: Crisis24 (provider of CodeRED system)
Containment Measures: Prompt closure of the affected server
Remediation Measures: Migration to another Crisis24 server
Recovery Measures: Restoration of alerting and public notification capabilities by late November 2024
Communication Strategy: Public disclosure via Dakota News NowLetter from Crisis24 published on the city website with FAQs and contact emailAlternative communication channels (news stations) for snow emergencies
What is the company's incident response plan?
Incident Response Plan: The company's incident response plan is described as Yes (forensic analysis conducted; platform decommissioned), , , , , , Yes (forensic analysis, security audit, third-party penetration testing), Yes (coordination between Harrisburg and Crisis24).
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through External cybersecurity experts, , external security experts (for penetration testing and hardening), , Yes (penetration testing, security audit), Crisis24 (provider of CodeRED system).
Data Breach Information
What type of data was compromised in each breach ?
Incident : Cyberattack EME1521815112525
Type of Data Compromised: Personally identifiable information (pii)
Sensitivity of Data: High (personal information requiring credit monitoring)
Data Exfiltration: Likely (data lost but not published online)
Incident : Data Breach EME0664306112525
Type of Data Compromised: Pii (personally identifiable information), Authentication credentials
Sensitivity of Data: Moderate to High (risk of credential stuffing and identity aggregation)
Data Exfiltration: Confirmed (data published online)
Personally Identifiable Information: NamesAddressesEmail addressesPhone numbers
Incident : Data Breach EME2592825112525
Type of Data Compromised: Personal identifiable information (pii)
Sensitivity of Data: Moderate (contact information and passwords, but no financial or highly sensitive data confirmed)
Data Exfiltration: Data removed from the system; no evidence of online publication but risk of future leak remains
Personally Identifiable Information: NamesAddressesEmail addressesPhone numbersPasswords
Incident : ransomware EME5640356112625
Type of Data Compromised: Personally identifiable information (pii), Authentication credentials
Sensitivity of Data: High (PII + passwords)
Data Exfiltration: Confirmed; some files published online and offered for sale
Data Encryption: Yes (ransomware deployed on November 10)
Personally Identifiable Information: namesemail addressesphysical addressesphone numberspasswords
Incident : cyberattack EME3841238112625
Type of Data Compromised: Personally identifiable information (pii)
Sensitivity of Data: high (includes passwords, which could enable credential stuffing attacks)
Data Encryption: True
File Types Exposed: .csv files (containing user data)
Personally Identifiable Information: namesaddressesemail addressesphone numbersaccount passwords
Incident : Data Breach EME1592315112625
Type of Data Compromised: Personally identifiable information (pii), Authentication credentials
Sensitivity of Data: High (includes passwords and PII)
Data Encryption: True
Personally Identifiable Information: NamesAddressesEmailsPhone numbers
Incident : cyberattack EME1392513112625
Type of Data Compromised: Contact information (name, address, email, phone), Passwords, User profiles
Sensitivity of Data: high (PII, credentials)
Incident : cyberattack EME2692726112625
Type of Data Compromised: Personally identifiable information (pii), Authentication credentials
Sensitivity of Data: High
Data Exfiltration: Yes (data stolen and offered for sale)
Data Encryption: Yes (ransomware encryption on November 10)
Personally Identifiable Information: namesaddressesphone numbersemail addresses
Incident : Ransomware Attack / Data Breach EME5262152112725
Type of Data Compromised: Personally identifiable information (pii)
Sensitivity of Data: High (includes passwords, which may be reused across accounts)
Data Exfiltration: Yes (PII leaked on dark web by INC ransomware)
Personally Identifiable Information: NamesAddressesEmail addressesPhone numbersPasswords
Incident : Cyber Attack EME5462554112725
Type of Data Compromised: Personally identifiable information (pii)
Sensitivity of Data: Low to moderate (names, addresses, emails, phone numbers; no financial or highly sensitive data)
Data Exfiltration: Unconfirmed (data accessed but no confirmation of exfiltration)
Personally Identifiable Information: NamesAddressesEmail addressesPhone numbers
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Evaluation of alternative alert providers, , Accelerated rollout of 'CodeRED by Crisis24' platform, , Launch of new CodeRED platform on a non-compromised, separate environment, Comprehensive security audit, Penetration testing and hardening by external experts, , Transition to a new CodeRED platform (legacy platform discontinued), full security audit, penetration testing, system hardening, new platform built in uncompromised environment, , Password reset advisory for users, Migration to new platform, , rebuilding from outdated backups, , Launch of new notification platform on 2025-11-28, , Accelerated rollout of new CodeRED platform, Migration of all customers to new system, Security audit and penetration testing, , Migration to another Crisis24 server, .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by discontinuation of codered system, , decommissioning of legacy onsolve codered platform, isolation of affected environment, , decommissioning of onsolve codered platform, isolation of the incident to the third-party vendor's system, , decommissioning of compromised codered platform, migration to new secure platform, , decommissioned legacy codered platform, accelerated rollout of new codered by crisis24 platform, , sunsetting legacy codered platform, migration to new version, , maintained ability to send critical notifications despite outage, , isolation of legacy codered environment; decommissioning of affected system, prompt closure of the affected server and .
Ransomware Information
Was ransomware involved in any of the incidents ?
Incident : Data Breach EME0664306112525
Data Exfiltration: Yes (data published online)
Incident : Data Breach EME2592825112525
Data Exfiltration: Data removed from the system
Incident : ransomware EME5640356112625
Ransom Paid: $100,000 (offered by vendor, but negotiations failed)
Data Encryption: Yes
Data Exfiltration: Yes (double extortion)
Incident : cyberattack EME3841238112625
Ransom Demanded: $100,000
Ransomware Strain: INC Ransom
Data Encryption: True
Data Exfiltration: True
Incident : Data Breach EME1592315112625
Ransomware Strain: INC Ransom
Data Encryption: True
Data Exfiltration: True
Incident : cyberattack EME2692726112625
Ransom Demanded: Yes (amount undisclosed)
Ransom Paid: No (reportedly refused by Crisis24)
Ransomware Strain: INC ransomware
Data Encryption: Yes (on November 10)
Data Exfiltration: Yes (data stolen prior to encryption)
Incident : Ransomware Attack / Data Breach EME5262152112725
Ransomware Strain: INC Ransomware
Data Encryption: Likely (system damage reported)
Data Exfiltration: Yes (PII leaked)
Incident : Cyber Attack EME5462554112725
Ransom Paid: No
Incident : cyberattack EME2962429112725
Ransomware Strain: INC RaaS
How does the company recover data encrypted by ransomware ?
Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Door-to-door notifications, Social media alerts, Potential new system adoption within 1–2 weeks, , Transition to new CodeRED platform by November 28, 2023, Use of alternative communication channels (local media, county website, social media) in the interim, , migration of all customers to new platform, , Transferring all customers to new CodeRED by Crisis24 platform, , Full service restoration planned for 2025-11-28, , Transition to new platform; customer notifications and advisories, Restoration of alerting and public notification capabilities by late November 2024, .
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : cyberattack EME1392513112625
Regulatory Notifications: FBI
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : Data Breach EME0664306112525
Lessons Learned: Proactive communication with stakeholders during incidents is critical to maintain trust., Legacy systems may pose higher risks and require accelerated replacement., Password reuse by users amplifies breach impacts; education on password hygiene is essential., Redundant alert systems are necessary for public safety continuity.
Incident : Data Breach EME1592315112625
Lessons Learned: Third-party and supply-chain vulnerabilities pose significant risks to public-sector agencies, particularly for vendors supporting critical government services like emergency alerting systems. Rapid migration to secure platforms and proactive communication are essential for mitigating reputational and operational damage.
Incident : Ransomware Attack / Data Breach EME5262152112725
Lessons Learned: Legacy systems are high-risk targets for ransomware; importance of system isolation and accelerated migration to secure platforms; need for robust password policies to mitigate credential reuse risks.
Incident : Cyber Attack EME5462554112725
Lessons Learned: Increasing reliance on online services heightens exposure to cyber risks, even for critical systems like emergency notifications. Proactive coordination with service providers and backup communication plans are essential for resilience.
What recommendations were made to prevent future incidents ?
Incident : Cyberattack EME1521815112525
Recommendations: Transition to more secure emergency alert systems, Proactive credit monitoring for affected residents, Multi-channel alert redundancyTransition to more secure emergency alert systems, Proactive credit monitoring for affected residents, Multi-channel alert redundancyTransition to more secure emergency alert systems, Proactive credit monitoring for affected residents, Multi-channel alert redundancy
Incident : Data Breach EME0664306112525
Recommendations: Implement real-time monitoring and alerting for system outages., Establish clear protocols for notifying affected parties during breaches., Conduct regular security audits of emergency notification platforms., Promote multi-factor authentication (MFA) and password managers to users., Develop backup communication channels for emergencies (e.g., IPAWS, RAVE).Implement real-time monitoring and alerting for system outages., Establish clear protocols for notifying affected parties during breaches., Conduct regular security audits of emergency notification platforms., Promote multi-factor authentication (MFA) and password managers to users., Develop backup communication channels for emergencies (e.g., IPAWS, RAVE).Implement real-time monitoring and alerting for system outages., Establish clear protocols for notifying affected parties during breaches., Conduct regular security audits of emergency notification platforms., Promote multi-factor authentication (MFA) and password managers to users., Develop backup communication channels for emergencies (e.g., IPAWS, RAVE).Implement real-time monitoring and alerting for system outages., Establish clear protocols for notifying affected parties during breaches., Conduct regular security audits of emergency notification platforms., Promote multi-factor authentication (MFA) and password managers to users., Develop backup communication channels for emergencies (e.g., IPAWS, RAVE).Implement real-time monitoring and alerting for system outages., Establish clear protocols for notifying affected parties during breaches., Conduct regular security audits of emergency notification platforms., Promote multi-factor authentication (MFA) and password managers to users., Develop backup communication channels for emergencies (e.g., IPAWS, RAVE).
Incident : Data Breach EME2592825112525
Recommendations: Use unique, long, and random passwords for each account, Avoid password reuse across multiple platforms, Monitor for potential identity theft or fraud, Follow cybersecurity best practices for personal and organizational securityUse unique, long, and random passwords for each account, Avoid password reuse across multiple platforms, Monitor for potential identity theft or fraud, Follow cybersecurity best practices for personal and organizational securityUse unique, long, and random passwords for each account, Avoid password reuse across multiple platforms, Monitor for potential identity theft or fraud, Follow cybersecurity best practices for personal and organizational securityUse unique, long, and random passwords for each account, Avoid password reuse across multiple platforms, Monitor for potential identity theft or fraud, Follow cybersecurity best practices for personal and organizational security
Incident : cyberattack EME3841238112625
Recommendations: Change passwords reused across multiple accounts, Monitor for potential identity theft or credential stuffing attacks, Ensure vendors implement robust security measures (e.g., penetration testing, hardening), Avoid paying ransoms to threat actorsChange passwords reused across multiple accounts, Monitor for potential identity theft or credential stuffing attacks, Ensure vendors implement robust security measures (e.g., penetration testing, hardening), Avoid paying ransoms to threat actorsChange passwords reused across multiple accounts, Monitor for potential identity theft or credential stuffing attacks, Ensure vendors implement robust security measures (e.g., penetration testing, hardening), Avoid paying ransoms to threat actorsChange passwords reused across multiple accounts, Monitor for potential identity theft or credential stuffing attacks, Ensure vendors implement robust security measures (e.g., penetration testing, hardening), Avoid paying ransoms to threat actors
Incident : Data Breach EME1592315112625
Recommendations: Enhance third-party vendor security assessments for public-sector suppliers., Implement multi-factor authentication (MFA) for all user accounts to mitigate credential reuse risks., Conduct regular forensic analyses to detect and contain breaches early., Develop robust incident response plans for cloud-based critical infrastructure.Enhance third-party vendor security assessments for public-sector suppliers., Implement multi-factor authentication (MFA) for all user accounts to mitigate credential reuse risks., Conduct regular forensic analyses to detect and contain breaches early., Develop robust incident response plans for cloud-based critical infrastructure.Enhance third-party vendor security assessments for public-sector suppliers., Implement multi-factor authentication (MFA) for all user accounts to mitigate credential reuse risks., Conduct regular forensic analyses to detect and contain breaches early., Develop robust incident response plans for cloud-based critical infrastructure.Enhance third-party vendor security assessments for public-sector suppliers., Implement multi-factor authentication (MFA) for all user accounts to mitigate credential reuse risks., Conduct regular forensic analyses to detect and contain breaches early., Develop robust incident response plans for cloud-based critical infrastructure.
Incident : cyberattack EME1392513112625
Recommendations: avoid password reuse across accounts, regular backup testing, modernize legacy systemsavoid password reuse across accounts, regular backup testing, modernize legacy systemsavoid password reuse across accounts, regular backup testing, modernize legacy systems
Incident : Cyberattack (Service Disruption) EME2692826112625
Recommendations: Users advised to change passwords that are the same or similar to their CodeRED platform password, Regular password updates and multi-factor authentication (implied)Users advised to change passwords that are the same or similar to their CodeRED platform password, Regular password updates and multi-factor authentication (implied)
Incident : Ransomware Attack / Data Breach EME5262152112725
Recommendations: Implement multi-factor authentication (MFA) for user accounts, Conduct regular security audits and penetration testing for critical systems, Ensure clear segmentation between legacy and new systems, Provide timely and transparent communication to affected users and stakeholders, Encourage users to avoid password reuse across platformsImplement multi-factor authentication (MFA) for user accounts, Conduct regular security audits and penetration testing for critical systems, Ensure clear segmentation between legacy and new systems, Provide timely and transparent communication to affected users and stakeholders, Encourage users to avoid password reuse across platformsImplement multi-factor authentication (MFA) for user accounts, Conduct regular security audits and penetration testing for critical systems, Ensure clear segmentation between legacy and new systems, Provide timely and transparent communication to affected users and stakeholders, Encourage users to avoid password reuse across platformsImplement multi-factor authentication (MFA) for user accounts, Conduct regular security audits and penetration testing for critical systems, Ensure clear segmentation between legacy and new systems, Provide timely and transparent communication to affected users and stakeholders, Encourage users to avoid password reuse across platformsImplement multi-factor authentication (MFA) for user accounts, Conduct regular security audits and penetration testing for critical systems, Ensure clear segmentation between legacy and new systems, Provide timely and transparent communication to affected users and stakeholders, Encourage users to avoid password reuse across platforms
Incident : Cyber Attack EME5462554112725
Recommendations: Enhance server security for emergency notification systems., Implement multi-layered authentication and access controls., Develop redundant communication channels for critical alerts., Conduct regular cybersecurity audits for third-party vendors.Enhance server security for emergency notification systems., Implement multi-layered authentication and access controls., Develop redundant communication channels for critical alerts., Conduct regular cybersecurity audits for third-party vendors.Enhance server security for emergency notification systems., Implement multi-layered authentication and access controls., Develop redundant communication channels for critical alerts., Conduct regular cybersecurity audits for third-party vendors.Enhance server security for emergency notification systems., Implement multi-layered authentication and access controls., Develop redundant communication channels for critical alerts., Conduct regular cybersecurity audits for third-party vendors.
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are Proactive communication with stakeholders during incidents is critical to maintain trust.,Legacy systems may pose higher risks and require accelerated replacement.,Password reuse by users amplifies breach impacts; education on password hygiene is essential.,Redundant alert systems are necessary for public safety continuity.Third-party and supply-chain vulnerabilities pose significant risks to public-sector agencies, particularly for vendors supporting critical government services like emergency alerting systems. Rapid migration to secure platforms and proactive communication are essential for mitigating reputational and operational damage.Legacy systems are high-risk targets for ransomware; importance of system isolation and accelerated migration to secure platforms; need for robust password policies to mitigate credential reuse risks.Increasing reliance on online services heightens exposure to cyber risks, even for critical systems like emergency notifications. Proactive coordination with service providers and backup communication plans are essential for resilience.
References
Where can I find more information about each incident ?
Incident : Cyberattack EME1521815112525
Source: The Denver Post (or original news outlet)
Date Accessed: 2023-11-27
Incident : Data Breach EME0664306112525
Source: Denver7 News
Incident : Data Breach EME0664306112525
Source: Douglas County Sheriff's Office (DCSO) Statements
Incident : Data Breach EME0664306112525
Source: Crisis24 Public Statement
Incident : Data Breach EME0664306112525
Source: Thornton Police Department Social Media
Incident : Data Breach EME0664306112525
Source: Arapahoe County Sheriff's Office
Incident : Data Breach EME0664306112525
Source: City of Aurora Social Media
Incident : Data Breach EME0664306112525
Source: Dr. Steve Beaty (Metropolitan State University of Denver)
Incident : Data Breach EME2592825112525
Source: Craven County Official Statement
Incident : Data Breach EME2592825112525
Source: CodeRED by Crisis24 FAQs
Incident : ransomware EME5640356112625
Source: SecurityWeek
Incident : ransomware EME5640356112625
Source: Local government notifications (multiple U.S. states)
Incident : cyberattack EME3841238112625
Source: SecurityAffairs
URL: https://securityaffairs.co/wordpress/149820/cyber-crime/onsolve-codered-cyberattack.html
Date Accessed: 2025-11-26
Incident : cyberattack EME3841238112625
Source: City of University Park, Texas - Emergency Notification
Date Accessed: 2025-11-26
Incident : Data Breach EME1592315112625
Source: Bleeping Computer
URL: https://www.bleepingcomputer.com
Date Accessed: 2023-11-14
Incident : Data Breach EME1592315112625
Source: Crisis24 (OnSolve Parent Company) Email Disclosure
Date Accessed: 2023-11-15
Incident : Data Breach EME1592315112625
Source: Douglas County Sheriff (Colorado) Social Media Announcement
Date Accessed: 2023-11-15
Incident : Data Breach EME1592315112625
Source: City of Weston (Florida) Web Announcement
Date Accessed: 2023-11-15
Incident : cyberattack EME1392513112625
Source: TechRadar
Incident : cyberattack EME1392513112625
Source: BleepingComputer
Incident : cyberattack EME2692726112625
Source: BleepingComputer
Incident : Cyberattack (Service Disruption) EME2692826112625
Source: WECT News
URL: https://www.wect.com/2025/11/xx/surf-city-warns-of-cyberattack-affecting-codered-system/
Incident : Cyberattack (Service Disruption) EME2692826112625
Source: Town of Surf City Facebook Post
Incident : Ransomware Attack / Data Breach EME5262152112725
Source: Crisis24 Public Statement
Incident : Ransomware Attack / Data Breach EME5262152112725
Source: Douglas County Sheriff’s Office Advisory
Incident : Ransomware Attack / Data Breach EME5262152112725
Source: INC Ransomware Data Leak Site
Incident : Cyber Attack EME5462554112725
Source: Dakota News Now
URL: https://www.dakotanewsnow.com/2024/11/2x/ (hypothetical; actual URL not provided in text)
Date Accessed: 2025 (article copyright date)
Incident : Cyber Attack EME5462554112725
Source: City of Harrisburg Website (Letter from Crisis24)
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: The Denver Post (or original news outlet)Date Accessed: 2023-11-27, and Source: Denver7 News, and Source: Douglas County Sheriff's Office (DCSO) Statements, and Source: Crisis24 Public Statement, and Source: Thornton Police Department Social Media, and Source: Arapahoe County Sheriff's Office, and Source: City of Aurora Social Media, and Source: Dr. Steve Beaty (Metropolitan State University of Denver), and Source: Craven County Official Statement, and Source: CodeRED by Crisis24 FAQs, and Source: SecurityWeek, and Source: Inc Ransom leak siteDate Accessed: 2023-11-22, and Source: Local government notifications (multiple U.S. states), and Source: SecurityAffairsUrl: https://securityaffairs.co/wordpress/149820/cyber-crime/onsolve-codered-cyberattack.htmlDate Accessed: 2025-11-26, and Source: City of University Park, Texas - Emergency NotificationDate Accessed: 2025-11-26, and Source: Bleeping ComputerUrl: https://www.bleepingcomputer.comDate Accessed: 2023-11-14, and Source: Crisis24 (OnSolve Parent Company) Email DisclosureDate Accessed: 2023-11-15, and Source: Douglas County Sheriff (Colorado) Social Media AnnouncementDate Accessed: 2023-11-15, and Source: City of Weston (Florida) Web AnnouncementDate Accessed: 2023-11-15, and Source: TechRadar, and Source: BleepingComputer, and Source: BleepingComputer, and Source: WECT NewsUrl: https://www.wect.com/2025/11/xx/surf-city-warns-of-cyberattack-affecting-codered-system/, and Source: Town of Surf City Facebook Post, and Source: Crisis24 Public Statement, and Source: Douglas County Sheriff’s Office Advisory, and Source: INC Ransomware Data Leak Site, and Source: Dakota News NowUrl: https://www.dakotanewsnow.com/2024/11/2x/ (hypothetical; actual URL not provided in text)Date Accessed: 2025 (article copyright date), and Source: City of Harrisburg Website (Letter from Crisis24), and Source: BleepingComputerDate Accessed: 2025-11-26.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Cyberattack EME1521815112525
Investigation Status: Ongoing (no details on root cause or threat actor)
Incident : Data Breach EME0664306112525
Investigation Status: Ongoing (forensic analysis mentioned; no final report cited)
Incident : Data Breach EME2592825112525
Investigation Status: Ongoing (provider investigation suggests data limited to contact information and passwords; no evidence of identity theft or fraud)
Incident : ransomware EME5640356112625
Investigation Status: Ongoing (as of late November 2023)
Incident : cyberattack EME3841238112625
Investigation Status: Ongoing (no stolen data found online as of disclosure, but future leaks possible)
Incident : Data Breach EME1592315112625
Investigation Status: Ongoing (law enforcement involved)
Incident : cyberattack EME1392513112625
Investigation Status: ongoing (FBI notified)
Incident : cyberattack EME2692726112625
Investigation Status: Ongoing (no misuse of stolen data observed as of disclosure)
Incident : Cyberattack (Service Disruption) EME2692826112625
Investigation Status: Ongoing (implied by planned restoration and lack of detailed root cause)
Incident : Ransomware Attack / Data Breach EME5262152112725
Investigation Status: Ongoing (law enforcement notified)
Incident : Cyber Attack EME5462554112725
Investigation Status: Ongoing (restoration in progress; no final report mentioned)
Incident : cyberattack EME2962429112725
Investigation Status: ongoing (claimed by INC RaaS gang)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Disclosure, Advisories To Residents (Credit Bureau Checks), Media Statements, Limited (Criticized By Agencies For Lack Of Transparency), Public Statement Via Media (Denver7), Advisories To Users About Password Reuse Risks, Public Disclosure Of The Incident, Faqs Provided By Codered By Crisis24, Advisories For Users To Change Passwords, Collaboration With Craven County Emergency Services For Transparency, Limited; no public statement from Crisis24/OnSolve. Local governments issued notifications to residents., Public Notification By City Of University Park, Advisory To Change Reused Passwords, Transparency About Potential Future Data Leaks, Emails To Customers, Social Media And Web Announcements By Affected Jurisdictions (E.G., Douglas County Sheriff, City Of Weston), Public Disclosure Via Bleeping Computer, Customer Notification, Password Reset Advisory, Public disclosure of breach; emphasis on no observed misuse of stolen data, Public Announcement Via Facebook Post, Advisory For Users To Change Passwords, Media Coverage (Wect News Report), Public statements, customer notifications, and advisories to affected users (e.g., password change recommendations), Public Disclosure Via Dakota News Now, Letter From Crisis24 Published On The City Website With Faqs And Contact Email and Alternative Communication Channels (News Stations) For Snow Emergencies.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : Cyberattack EME1521815112525
Stakeholder Advisories: Residents advised to contact credit bureaus; counties evaluating alternative providers
Customer Advisories: Manual alerts (door-to-door, social media) until new system is adopted; residents may need to re-register for new alerts
Incident : Data Breach EME0664306112525
Stakeholder Advisories: Users Advised To Change Passwords If Reused Elsewhere., Agencies Advised To Transition To Alternative Platforms (E.G., Rave, Ipaws)..
Customer Advisories: Monitor financial accounts for suspicious activity.Avoid password reuse; use password managers.Sign up for alternative alert systems (e.g., FEMA IPAWS for large-scale events).
Incident : Data Breach EME2592825112525
Stakeholder Advisories: Craven County Emergency Services Collaboration With Codered By Crisis24 For New Platform, Public Advisories To Change Passwords And Use Unique Credentials.
Customer Advisories: Change passwords immediately if reused across other accountsMonitor for suspicious activity related to exposed dataUse alternative communication channels (local media, county website, social media) for emergency alerts during transition
Incident : ransomware EME5640356112625
Stakeholder Advisories: Notifications issued by local governments to residents about disrupted emergency alerts
Incident : cyberattack EME3841238112625
Stakeholder Advisories: City of University Park notified residents; OnSolve working with customers on migration to new platform
Customer Advisories: Users advised to change passwords reused elsewhere; no financial data impacted
Incident : Data Breach EME1592315112625
Stakeholder Advisories: Customers advised to change passwords, especially if reused for other accounts; migration to new platform underway.
Customer Advisories: Immediate password reset recommended; monitoring for identity theft advised.
Incident : cyberattack EME1392513112625
Stakeholder Advisories: Password Reset Advisory For Users.
Customer Advisories: termination of service by Douglas County entities due to privacy concerns
Incident : cyberattack EME2692726112625
Customer Advisories: Users notified of data breach (names, addresses, phone numbers, emails, passwords compromised)
Incident : Cyberattack (Service Disruption) EME2692826112625
Stakeholder Advisories: Public Advisory To Change Passwords, Notification Of New Platform Launch On 2025-11-28.
Customer Advisories: Password change recommendationAssurance that critical notifications were not interrupted
Incident : Ransomware Attack / Data Breach EME5262152112725
Stakeholder Advisories: Customers notified; agencies advised to warn users about PII exposure and password reuse risks
Customer Advisories: Users advised to change passwords for accounts where CodeRED credentials were reused
Incident : Cyber Attack EME5462554112725
Stakeholder Advisories: City coordinated with Crisis24 and prepared alternative communication methods for residents.
Customer Advisories: Public statement by Mayor Derick Wenck reassuring residents of limited risk.Letter from Crisis24 with FAQs and contact email for questions.
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Residents advised to contact credit bureaus; counties evaluating alternative providers, Manual alerts (door-to-door, social media) until new system is adopted; residents may need to re-register for new alerts, Users Advised To Change Passwords If Reused Elsewhere., Agencies Advised To Transition To Alternative Platforms (E.G., Rave, Ipaws)., Monitor Financial Accounts For Suspicious Activity., Avoid Password Reuse; Use Password Managers., Sign Up For Alternative Alert Systems (E.G., Fema Ipaws For Large-Scale Events)., , Craven County Emergency Services Collaboration With Codered By Crisis24 For New Platform, Public Advisories To Change Passwords And Use Unique Credentials, Change Passwords Immediately If Reused Across Other Accounts, Monitor For Suspicious Activity Related To Exposed Data, Use Alternative Communication Channels (Local Media, County Website, Social Media) For Emergency Alerts During Transition, , Notifications issued by local governments to residents about disrupted emergency alerts, City of University Park notified residents; OnSolve working with customers on migration to new platform, Users advised to change passwords reused elsewhere; no financial data impacted, Customers advised to change passwords, especially if reused for other accounts; migration to new platform underway., Immediate password reset recommended; monitoring for identity theft advised., Password Reset Advisory For Users, Termination Of Service By Douglas County Entities Due To Privacy Concerns, , Users notified of data breach (names, addresses, phone numbers, emails, passwords compromised), Public Advisory To Change Passwords, Notification Of New Platform Launch On 2025-11-28, Password Change Recommendation, Assurance That Critical Notifications Were Not Interrupted, , Customers notified; agencies advised to warn users about PII exposure and password reuse risks, Users advised to change passwords for accounts where CodeRED credentials were reused, City coordinated with Crisis24 and prepared alternative communication methods for residents., Public Statement By Mayor Derick Wenck Reassuring Residents Of Limited Risk., Letter From Crisis24 With Faqs And Contact Email For Questions. and .
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Data Breach EME0664306112525
High Value Targets: User Credentials (For Aggregation Attacks),
Data Sold on Dark Web: User Credentials (For Aggregation Attacks),
Incident : Data Breach EME2592825112525
High Value Targets: Onsolve Codered User Database,
Data Sold on Dark Web: Onsolve Codered User Database,
Incident : ransomware EME5640356112625
Reconnaissance Period: November 1–10, 2023 (access gained on Nov 1, ransomware deployed on Nov 10)
High Value Targets: Legacy Codered Platform User Data,
Data Sold on Dark Web: Legacy Codered Platform User Data,
Incident : cyberattack EME3841238112625
High Value Targets: User Databases (Containing Pii),
Data Sold on Dark Web: User Databases (Containing Pii),
Incident : Data Breach EME1592315112625
High Value Targets: Legacy Codered Platform Data,
Data Sold on Dark Web: Legacy Codered Platform Data,
Incident : cyberattack EME1392513112625
High Value Targets: Legacy Codered User Data,
Data Sold on Dark Web: Legacy Codered User Data,
Incident : cyberattack EME2692726112625
High Value Targets: Onsolve Codered Platform,
Data Sold on Dark Web: Onsolve Codered Platform,
Incident : Ransomware Attack / Data Breach EME5262152112725
High Value Targets: Onsolve Codered Legacy Platform,
Data Sold on Dark Web: Onsolve Codered Legacy Platform,
Incident : Cyber Attack EME5462554112725
High Value Targets: Codered Emergency Notification Server,
Data Sold on Dark Web: Codered Emergency Notification Server,
Incident : cyberattack EME2962429112725
High Value Targets: Emergency Notification Systems,
Data Sold on Dark Web: Emergency Notification Systems,
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Cyberattack EME1521815112525
Corrective Actions: Discontinuation Of Vulnerable System, Evaluation Of Secure Alternatives,
Incident : Data Breach EME0664306112525
Root Causes: Inadequate Incident Response Communication Protocols., Vulnerabilities In Legacy Onsolve Codered Platform., Delayed Detection/Response To The Attack.,
Corrective Actions: Decommissioning Of Legacy System., Accelerated Rollout Of New Platform ('Codered By Crisis24')., Public Advisories On Password Security.,
Incident : Data Breach EME2592825112525
Corrective Actions: Decommissioning Of Compromised Onsolve Codered Platform, Launch Of New Codered Platform With Enhanced Security Measures, Comprehensive Security Audit And Penetration Testing By External Experts, Public Education On Password Hygiene And Cybersecurity Best Practices,
Incident : ransomware EME5640356112625
Corrective Actions: Discontinuation Of Legacy Platform, Transition To New Codered Platform,
Incident : cyberattack EME3841238112625
Corrective Actions: Decommissioning Of Compromised Platform, Migration To New, Secured Environment, Security Audit And Penetration Testing, System Hardening,
Incident : Data Breach EME1592315112625
Root Causes: Targeted Attack By Organized Cybercriminal Group (Inc Ransom), Vulnerabilities In Legacy Codered Platform, Potential Supply-Chain Or Third-Party Risks,
Corrective Actions: Decommissioning Of Legacy Platform, Migration To New Codered By Crisis24 Platform, Enhanced Password Policies And User Advisories,
Incident : cyberattack EME1392513112625
Root Causes: Legacy System Vulnerabilities, Outdated Backups,
Corrective Actions: Platform Migration, Customer Data Protection Review,
Incident : Cyberattack (Service Disruption) EME2692826112625
Corrective Actions: Deployment Of A New Notification Platform,
Incident : Ransomware Attack / Data Breach EME5262152112725
Root Causes: Targeted Ransomware Attack By Organized Cybercriminal Group (Inc); Vulnerabilities In Legacy System,
Corrective Actions: Decommissioning Of Legacy Platform; Migration To New, Secure Platform; Security Audit And Penetration Testing,
Incident : Cyber Attack EME5462554112725
Corrective Actions: Migration To A Secure Crisis24 Server, Server Closure To Prevent Further Access,
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as External Cybersecurity Experts, , External Security Experts (For Penetration Testing And Hardening), , , Crisis24 (provider of CodeRED system).
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Discontinuation Of Vulnerable System, Evaluation Of Secure Alternatives, , Decommissioning Of Legacy System., Accelerated Rollout Of New Platform ('Codered By Crisis24')., Public Advisories On Password Security., , Decommissioning Of Compromised Onsolve Codered Platform, Launch Of New Codered Platform With Enhanced Security Measures, Comprehensive Security Audit And Penetration Testing By External Experts, Public Education On Password Hygiene And Cybersecurity Best Practices, , Discontinuation Of Legacy Platform, Transition To New Codered Platform, , Decommissioning Of Compromised Platform, Migration To New, Secured Environment, Security Audit And Penetration Testing, System Hardening, , Decommissioning Of Legacy Platform, Migration To New Codered By Crisis24 Platform, Enhanced Password Policies And User Advisories, , Platform Migration, Customer Data Protection Review, , Deployment Of A New Notification Platform, , Decommissioning Of Legacy Platform; Migration To New, Secure Platform; Security Audit And Penetration Testing, , Migration To A Secure Crisis24 Server, Server Closure To Prevent Further Access, .
Additional Questions
General Information
Has the company ever paid ransoms ?
Ransom Payment History: The company has Paid ransoms in the past.
What was the amount of the last ransom demanded ?
Last Ransom Demanded: The amount of the last ransom demanded was $100,000.
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an Organized cybercriminal group, Organized cybercriminal group, Inc Ransom, INC Ransom group, INC Ransom gang, INC Ransom, INC ransomware-as-a-service gang, INC Ransomware (organized cybercriminal group) and INC ransomware-as-a-service (RaaS) gang.
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2023-11-21.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-11-26.
What was the most recent incident resolved ?
Most Recent Incident Resolved: The most recent incident resolved was on 2025-11-28.
Impact of the Incidents
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Names, Addresses, Email addresses, Phone numbers, Passwords (hashed/plaintext unclear), , Names, Addresses, Email addresses, Phone numbers, Passwords, , names, email addresses, physical addresses, phone numbers, user profile passwords (legacy platform), , , Names, Addresses, Emails, Phone numbers, Passwords, , user contact information (name, address, email, phone numbers), passwords, sensitive organizational data, , names, addresses, phone numbers, email addresses, passwords, , Names, Addresses, Email addresses, Phone numbers, Passwords, , Names, Addresses, Email addresses, Phone numbers and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident was CodeRED emergency alert system and CodeRED emergency alert platform (legacy OnSolve environment) and OnSolve CodeRED platform and OnSolve CodeRED emergency alert system (legacy platform) and OnSolve CodeRED alert platform (previous version) and Legacy CodeRED alerting platform and legacy CodeRED platform and OnSolve CodeRED platform and CodeRED emergency notification system and OnSolve CodeRED legacy platform and OnSolve CodeRED emergency notification system (single server) and OnSolve CodeRED emergency notification platform.
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was external cybersecurity experts, , external security experts (for penetration testing and hardening), , , Crisis24 (provider of CodeRED system).
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Discontinuation of CodeRED system, Decommissioning of legacy OnSolve CodeRED platformIsolation of affected environment, Decommissioning of OnSolve CodeRED platformIsolation of the incident to the third-party vendor's system, decommissioning of compromised CodeRED platformmigration to new secure platform, Decommissioned legacy CodeRED platformAccelerated rollout of new CodeRED by Crisis24 platform, sunsetting legacy CodeRED platformmigration to new version, Maintained ability to send critical notifications despite outage, Isolation of legacy CodeRED environment; decommissioning of affected system and Prompt closure of the affected server.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Email addresses, Addresses, addresses, Phone numbers, email addresses, physical addresses, user profile passwords (legacy platform), Passwords (hashed/plaintext unclear), sensitive organizational data, Emails, phone numbers, Passwords, user contact information (name, address, email, phone numbers), passwords, names and Names.
Ransomware Information
What was the highest ransom demanded in a ransomware incident ?
Highest Ransom Demanded: The highest ransom demanded in a ransomware incident was $100,000.
What was the highest ransom paid in a ransomware incident ?
Highest Ransom Paid: The highest ransom paid in a ransomware incident was No.
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Redundant alert systems are necessary for public safety continuity., Third-party and supply-chain vulnerabilities pose significant risks to public-sector agencies, particularly for vendors supporting critical government services like emergency alerting systems. Rapid migration to secure platforms and proactive communication are essential for mitigating reputational and operational damage., Legacy systems are high-risk targets for ransomware; importance of system isolation and accelerated migration to secure platforms; need for robust password policies to mitigate credential reuse risks., Increasing reliance on online services heightens exposure to cyber risks, even for critical systems like emergency notifications. Proactive coordination with service providers and backup communication plans are essential for resilience.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Encourage users to avoid password reuse across platforms, Implement multi-factor authentication (MFA) for user accounts, Enhance server security for emergency notification systems., Users advised to change passwords that are the same or similar to their CodeRED platform password, Conduct regular security audits of emergency notification platforms., Regular password updates and multi-factor authentication (implied), Transition to more secure emergency alert systems, Develop redundant communication channels for critical alerts., avoid password reuse across accounts, Conduct regular cybersecurity audits for third-party vendors., Ensure clear segmentation between legacy and new systems, Use unique, long, and random passwords for each account, Enhance third-party vendor security assessments for public-sector suppliers., Conduct regular security audits and penetration testing for critical systems, Implement real-time monitoring and alerting for system outages., Avoid paying ransoms to threat actors, Implement multi-factor authentication (MFA) for all user accounts to mitigate credential reuse risks., Ensure vendors implement robust security measures (e.g., penetration testing, hardening), Proactive credit monitoring for affected residents, Multi-channel alert redundancy, regular backup testing, Monitor for potential identity theft or credential stuffing attacks, modernize legacy systems, Follow cybersecurity best practices for personal and organizational security, Avoid password reuse across multiple platforms, Monitor for potential identity theft or fraud, Develop robust incident response plans for cloud-based critical infrastructure., Provide timely and transparent communication to affected users and stakeholders, Change passwords reused across multiple accounts, Establish clear protocols for notifying affected parties during breaches., Promote multi-factor authentication (MFA) and password managers to users., Develop backup communication channels for emergencies (e.g., IPAWS, RAVE)., Implement multi-layered authentication and access controls. and Conduct regular forensic analyses to detect and contain breaches early..
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are Douglas County Sheriff's Office (DCSO) Statements, Arapahoe County Sheriff's Office, Denver7 News, Crisis24 Public Statement, INC Ransomware Data Leak Site, SecurityAffairs, Douglas County Sheriff’s Office Advisory, Dakota News Now, Douglas County Sheriff (Colorado) Social Media Announcement, City of University Park, Texas - Emergency Notification, SecurityWeek, CodeRED by Crisis24 FAQs, Craven County Official Statement, WECT News, Local government notifications (multiple U.S. states), Town of Surf City Facebook Post, Bleeping Computer, City of Harrisburg Website (Letter from Crisis24), TechRadar, Dr. Steve Beaty (Metropolitan State University of Denver), Thornton Police Department Social Media, The Denver Post (or original news outlet), Inc Ransom leak site, City of Weston (Florida) Web Announcement, City of Aurora Social Media, BleepingComputer and Crisis24 (OnSolve Parent Company) Email Disclosure.
What is the most recent URL for additional resources on cybersecurity best practices ?
Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://securityaffairs.co/wordpress/149820/cyber-crime/onsolve-codered-cyberattack.html, https://www.bleepingcomputer.com, https://www.wect.com/2025/11/xx/surf-city-warns-of-cyberattack-affecting-codered-system/, https://www.dakotanewsnow.com/2024/11/2x/ (hypothetical; actual URL not provided in text) .
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (no details on root cause or threat actor).
Stakeholder and Customer Advisories
What was the most recent stakeholder advisory issued ?
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Residents advised to contact credit bureaus; counties evaluating alternative providers, Users advised to change passwords if reused elsewhere., Agencies advised to transition to alternative platforms (e.g., RAVE, IPAWS)., Craven County Emergency Services collaboration with CodeRED by Crisis24 for new platform, Public advisories to change passwords and use unique credentials, Notifications issued by local governments to residents about disrupted emergency alerts, City of University Park notified residents; OnSolve working with customers on migration to new platform, Customers advised to change passwords, especially if reused for other accounts; migration to new platform underway., password reset advisory for users, Public advisory to change passwords, Notification of new platform launch on 2025-11-28, Customers notified; agencies advised to warn users about PII exposure and password reuse risks, City coordinated with Crisis24 and prepared alternative communication methods for residents., .
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an Manual alerts (door-to-door, social media) until new system is adopted; residents may need to re-register for new alerts, Monitor financial accounts for suspicious activity.Avoid password reuse; use password managers.Sign up for alternative alert systems (e.g., FEMA IPAWS for large-scale events)., Change passwords immediately if reused across other accountsMonitor for suspicious activity related to exposed dataUse alternative communication channels (local media, county website, social media) for emergency alerts during transition, Users advised to change passwords reused elsewhere; no financial data impacted, Immediate password reset recommended; monitoring for identity theft advised., termination of service by Douglas County entities due to privacy concerns, Users notified of data breach (names, addresses, phone numbers, emails, passwords compromised), Password change recommendationAssurance that critical notifications were not interrupted, Users advised to change passwords for accounts where CodeRED credentials were reused and Public statement by Mayor Derick Wenck reassuring residents of limited risk.Letter from Crisis24 with FAQs and contact email for questions.
Initial Access Broker
What was the most recent reconnaissance period for an incident ?
Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was November 1–10, 2023 (access gained on Nov 1, ransomware deployed on Nov 10).
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Inadequate incident response communication protocols.Vulnerabilities in legacy OnSolve CodeRED platform.Delayed detection/response to the attack., Targeted attack by organized cybercriminal group (INC Ransom)Vulnerabilities in legacy CodeRED platformPotential supply-chain or third-party risks, legacy system vulnerabilitiesoutdated backups, Targeted ransomware attack by organized cybercriminal group (INC); vulnerabilities in legacy system.
What was the most significant corrective action taken based on post-incident analysis ?
Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Discontinuation of vulnerable systemEvaluation of secure alternatives, Decommissioning of legacy system.Accelerated rollout of new platform ('CodeRED by Crisis24').Public advisories on password security., Decommissioning of compromised OnSolve CodeRED platformLaunch of new CodeRED platform with enhanced security measuresComprehensive security audit and penetration testing by external expertsPublic education on password hygiene and cybersecurity best practices, Discontinuation of legacy platformTransition to new CodeRED platform, Decommissioning of compromised platformMigration to new, secured environmentSecurity audit and penetration testingSystem hardening, Decommissioning of legacy platformMigration to new CodeRED by Crisis24 platformEnhanced password policies and user advisories, platform migrationcustomer data protection review, Deployment of a new notification platform, Decommissioning of legacy platform; migration to new, secure platform; security audit and penetration testing, Migration to a secure Crisis24 serverServer closure to prevent further access.
.png)
Latest Global CVEs (Not Company-Specific)
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
- https://github.com/angular/angular/releases/tag/19.2.16
- https://github.com/angular/angular/releases/tag/20.3.14
- https://github.com/angular/angular/releases/tag/21.0.1
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 8.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 6.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=emergency-communications-network-llc' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
