Loading story…
Leduc County experienced a deliberate ransomware attack on December 25, which disabled several of the county’s information technology systems. The incident led to the proactive shutdown of additional IT services as a precaution during an ongoing forensic investigation. Key stakeholders, including the RCMP, insurance, and banking providers, were notified, and affected services included the county’s email platform, safety codes permits, development permits online portal, and website form submissions.
Authorities responded quickly to the incident, with the RCMP receiving a report on Christmas Day. County officials stated that the attack was detected early, allowing for rapid engagement of cybersecurity experts and containment measures. Preliminary findings suggest minimal information was compromised, and the county is working to restore normal operations, though no timeline has been provided. Updates will be communicated to residents and stakeholders as the investigation progresses. No threat actor has claimed responsibility for the attack at this time.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In the aftermath of the incident, several public-facing services were unavailable, including email, safety codes permits, development permits, and website form submissions. At the time of reporting, no threat actor had publicly claimed responsibility.
Following the attack, the county proactively shut down additional IT systems while a forensic investigation was launched. The RCMP, insurance providers, and banking partners were notified as part of the response.
Leduc County said it was deliberately targeted by a ransomware attack on December 25, disabling several of its IT systems. The incident disrupted county technology operations and triggered an active response.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The City of Coweta, Oklahoma said a ransomware attack caused a system-wide outage across city computers, files, and computer-based services, disrupting municipal operations while leaving the city website and a third-party online billing portal accessible. Officials said the intrusion affected city systems broadly, prompting an immediate response with the city's contracted IT provider and additional cybersecurity professionals to secure the environment, contain further intrusion, and begin recovery efforts. City officials said the Coweta Police Department and Fire Department were not affected because they operate through off-site systems, and emergency services including **911** remained operational throughout the incident. The city also said it has an **offsite backup** and plans to use it to restore data once systems are cleared and deemed safe for recovery.
Aug 10, 2026
A ransomware attack hit facility maintenance systems at **Health Sciences Centre** in Winnipeg, disrupting building operations including **door access** and **heating, ventilation, and air conditioning (HVAC)** controls. Shared Health, which oversees the hospital, said **patient care and clinical operations continued uninterrupted** and that there was **no indication patients were affected**. The organization said the incident appeared limited to those systems and that no other hospital systems were known to be impacted. Shared Health said it launched an investigation into the nature and scope of the attack, notified the Manitoba government, and brought in expert assistance to respond. Reporting on the incident highlighted the growing risk ransomware poses to **operational technology** in healthcare environments, where attacks can disrupt physical infrastructure even when core clinical systems remain online. The attack also follows earlier warnings from Manitoba’s auditor general that Shared Health needed stronger cybersecurity testing and training to improve its readiness for cyber incidents.
Aug 13, 2026
The City of Dallas said the **Royal** ransomware gang gained access to municipal systems on April 7, 2023, spent weeks conducting surveillance, and exfiltrated about **1.17 TB** of data before launching ransomware at 2 a.m. on May 3. The attack damaged hundreds of servers and more than a thousand endpoint devices, disrupting critical city operations including public safety dispatch, with police and ambulances reportedly sent to incorrect locations. Dallas activated its incident response plan, brought in outside cybersecurity firms, and coordinated with the **FBI** and **CISA**; more than 90% of affected services were restored within 18 days, and the city later approved **$8.5 million** for recovery and breach-notification work. Reporting on the incident said the intrusion exposed longstanding technical debt inside city systems, including outdated and unsupported software that increased risk despite recent gains in cybersecurity staffing and spending. The disruption echoed earlier ransomware damage in Atlanta, where city networks were hobbled by an attack linked to **SamSam**, forcing widespread shutdowns and recovery efforts with federal and private-sector assistance. Together, the incidents show how major U.S. municipalities remain high-value ransomware targets when internet-facing systems, patching gaps, and legacy infrastructure leave essential public services vulnerable.
Jun 29, 2026