INC Ransom Publishes Data Samples for City of Acworth GA and Oak Park MI; Pennington County SD Network Down During Active Election Window

INC Ransom listed the City of Acworth, Georgia (which confirmed a June 8 cyberattack on municipal systems) and the City of Oak Park, Michigan on its dark web leak site on July 2–3, continuing a documented pattern of INC targeting U.S. municipalities. Separately, Pennington County, South Dakota closed most public offices on July 6 after a network-affecting cybersecurity incident, with the South Dakota National Guard Cyber Incident Response Team, CISA, and the SD Fusion Center engaged — critically, the county is within an active absentee voting period ahead of a July 28 gubernatorial runoff election. No ransomware group has claimed Pennington County, and the attack vector and scope remain under active investigation; the timing relative to election infrastructure warrants close monitoring by state and federal authorities.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.