Backups could not answer the D.C. police data leak

The week

Around April 26, 2021, the Babuk ransomware group posted on its leak site that it had stolen a large volume of data from the Metropolitan Police Department in Washington, D.C. Ransomware is malicious software that criminals use to lock up an organization’s computer systems and demand payment for the key. A leak site is a website criminal groups run, usually on the hidden parts of the internet, where they name victims and publish stolen files to pressure them into paying.

Babuk was a newcomer. It had appeared at the start of 2021 and run the usual playbook: break in, steal data, encrypt systems, then demand payment for both a decryption key and silence. That same month it had also claimed to have stolen data from the Houston Rockets basketball franchise.

Most people expect a cyberattack on a city to look like screens going dark: dispatch systems frozen, offices back on paper. This attack was different, and in some ways worse. Nothing had to stop working. The threat was that secrets would be read.

Babuk’s threat was chilling. It said it would release information about informants, people who secretly help police, to criminal gangs unless it was paid, and according to the Associated Press it gave the department three days. Screenshots it posted pointed to intelligence reports, material on gang conflicts and the jail population, as well as administrative files. For an organization whose work depends on people trusting it with dangerous knowledge, few demands could be more pointed.

The department said it was aware of unauthorized access on its server and that it had engaged the FBI to investigate. It did not confirm a ransomware attack as such. Negotiations followed and failed. The AP later reported that the group had sought $4 million and claimed to have been offered $100,000; the department did not say whether it had made that offer.

In May, the group published in stages. An early release exposed details from officers’ background checks, including past drug use and personal finances. A much larger release followed in the middle of the month. An AP review found hundreds of officer disciplinary files, some dating back to 2004, and intelligence reports that included material from the FBI and the Secret Service. It was unclear whether informants’ names were among the files. This was information about the department’s own people, and its partners’ work, now available to anyone who went looking. Experts quoted by the AP described it as the worst known ransomware attack on a US police department.

Around the start of May, Babuk made an announcement that said a great deal about where criminal tactics were heading. It said it would stop encrypting victims’ systems, the “locking up” that defines classic ransomware, and focus on stealing and publishing data instead. It also offered its leak site to other criminal groups as a place to publish their own stolen data. The first version of the announcement was quickly replaced with a vaguer one, but the direction was clear. The group had decided the threat of exposure was enough on its own. Some researchers suggested the retreat was partly a reaction to the attention that threatening a US police force had drawn.

The incident landed in the middle of a busy month for ransomware policy. On April 20, the Deputy Attorney General had directed the creation of a Justice Department task force on ransomware and digital extortion. On April 29, the Ransomware Task Force, a coalition of industry, government and nonprofit experts convened by the Institute for Security and Technology, published a report with dozens of recommendations. A week later, on May 7, an attack on Colonial Pipeline shut down a major fuel pipeline on the East Coast. That attack was a reminder that encryption still did enormous damage. The D.C. case showed the other half of the problem.

The incident was among the most serious data extortion attacks on a US police agency to that point. For every public agency, it exposed an uncomfortable gap: a recovery plan built around restoring systems from backup copies has little to offer when the attacker does not care whether your systems work, only whether your files stay private.

Early ransomware planning centered on encryption: restore from backups and you need not pay. The D.C. incident showed why that plan was incomplete. The pressure came from stolen data, and backups do nothing about disclosure.

Payment logic changes too. When systems are encrypted, a payment buys a key that either works or does not. When data has been stolen, a payment buys only a promise of deletion from a criminal group that cannot prove it and has every reason to reuse the data. Responders and law enforcement have warned repeatedly that such promises are unreliable, and public agencies face added political, legal and sanctions constraints on paying at all. The department did not meet the demand, and the files were published. Planning should assume that outcome.

Public agencies face constraints a private company may not. The Treasury Department’s Office of Foreign Assets Control warned in October 2020 that facilitating ransom payments to sanctioned people or groups can violate US sanctions. Spending public money usually needs legal authority and an appropriation. In many jurisdictions, records of the decision and the payment could later be released under public records laws. A federal agency, a state police force and a small town’s department face different versions of these limits, but none of them can treat payment as a routine commercial transaction.

A promise of deletion from a criminal group is not something any agency can verify. There is no receipt, no audit and no court to enforce it. The data may be sold, reused against the same victim later, or simply kept. An agency that pays may find itself both poorer and still exposed, and having signaled to every other criminal group that it pays. The strongest plans therefore start from the assumption that stolen data will eventually be seen, and work backward from there.

That leaves one question: which data would cause harm if published, and to whom? Agency data falls into three categories with different owners and consequences: workforce data, operational data, and data held about the public. First, the mechanics of the attack itself. After the three categories, we turn to mapping the harm, running a two-track response, and the decisions that belong to agency leaders rather than the help desk.

From changed locks to photocopied files

Classic ransomware is like a burglar who breaks in, changes all the locks and sells you the new keys. Encryption is the lock: a mathematical scrambling of files that makes them unreadable without a secret key. Organizations learned to defend against this by keeping good backups, separate copies of their data stored where attackers cannot reach them. If the locks are changed, you rebuild from the copies and ignore the ransom note.

Data extortion is a burglar who photocopies your filing cabinets and threatens to post the copies on a public noticeboard. Your locks still work. Your backups are irrelevant. The harm lies entirely in other people seeing what was taken.

The key step is exfiltration, the technical word for copying data out of an organization’s network to somewhere the attacker controls. Attackers typically get in through a weak password, a phishing email that tricks an employee, or an unpatched flaw in internet-facing software. They then move through the network unnoticed, find the most valuable files and copy them out, often to ordinary cloud storage services, so the traffic blends in with normal business. This can take days. Only afterward does the attacker announce itself.

How a theft unfolds

Security agencies and incident responders have described a common sequence. Initial access often comes through a remote access service without multi-factor authentication, or a password bought from a criminal market. The intruder then steals more credentials, maps the network and looks for file servers, records systems and backups. Valuable files are gathered and compressed into archives. The archives are then copied out using ordinary file transfer or cloud synchronization tools, which security software may not flag.

Each stage leaves traces an agency can look for. Examples include a login from an unusual place, an administrator account used at odd hours, a burst of compression activity on a file server, or a large upload to an unfamiliar storage service. No single trace is conclusive. Together, and caught early, they are the difference between a contained intrusion and a leak site posting.

How the leak site applies pressure

The leak site is a pressure instrument. Groups typically post a victim’s name with a countdown, then a small sample of files as proof. If the victim does not engage, they release more in stages, as Babuk did in May 2021. Some groups contact journalists, employees or the people whose data was stolen, to multiply the pressure. The timing is set by the attacker, which is why an agency without a prepared disclosure plan loses the initiative from the first day.

Many groups did both at once, encrypting systems and stealing data, a tactic known as double extortion. Babuk’s announcement that it would drop encryption altogether simply made explicit what the D.C. case already showed: for many victims, the theft was the real source of pressure.

Why public agencies make attractive targets

Public agencies combine several features that extortion groups value. They hold dense collections of personal data on employees and residents. Many run older systems that are hard to patch, on budgets set a year or more in advance. Their incidents become public quickly, through open meetings, records requests and local news, which gives a leak site an audience. And their decisions about payment are visible and contested, which attackers may hope will produce pressure from inside the organization.

Workforce data: harm to employees

The files Babuk published included personnel and disciplinary records. For any agency, this category covers background investigations, medical and leave records, performance and discipline files, payroll and tax forms, and home addresses. In law enforcement, disclosure can put officers and their families at risk. Someone with a grudge now knows where an officer lives. It also affects labor relations, since disciplinary records may be subject to collective bargaining terms on retention and access, and a leak can breach agreements the agency made with its unions.

This data usually lives in human resources systems, payroll platforms and shared drives that get less security attention than mission systems. It is also commonly over-retained. Old background files and closed investigation records sit on file servers long after any business need, often because nobody is sure who may delete them.

Two controls matter most. Retention schedules that are actually enforced reduce exposure directly, because records that no longer exist cannot be stolen. A retention schedule is simply the rule for how long each type of record must be kept; the problem in most organizations is not the rule but the absence of anyone who carries it out. And HR, legal and the security team need a pre-agreed plan for telling employees what was taken and offering protection. Staff will learn about a leak from the press if the agency is slow. Few things damage morale faster than reading about your own disciplinary file in a news story.

The police case, and how state law changes it

Police disciplinary records are a special case because their legal status varies by state. Some states have opened more of them to the public in recent years. New York repealed its law shielding police personnel records in 2020, and California had already made certain misconduct records disclosable in 2019. In those places, some of what a criminal group publishes may already be obtainable by request. The harm then lies in what was never meant to be public: background investigation details, medical and family information, home addresses and unfounded complaints.

Disciplinary files also intersect with prosecutors’ duties. Prosecutors must disclose certain information that bears on a witness’s credibility, including some information about police officers. A leak can reopen questions about past cases and complicate future ones. The agency’s legal office and the local prosecutor need to talk early, before defense lawyers start citing the leaked files.

Practical support for staff

Many states let law enforcement officers and some other public employees shield their home addresses from public records. A leak overrides that protection at a stroke. Agencies should be ready to offer affected staff identity protection, help with removing personal details from data broker sites, security assessments for those at greatest risk, and access to employee assistance services. Unions should hear about the incident from the agency, not from their members.

Much workforce data is held by suppliers: payroll processors, benefits administrators, background investigation firms and cloud-based HR platforms. The agency remains answerable to its staff for that data. Contracts with those suppliers deserve the same notice and cooperation terms as contracts for mission systems.

Operational data: harm to the mission

The threat to expose informants pointed at the most sensitive category: information whose release would compromise investigations or endanger people who cooperate with the agency. In a police department, that means informant identities, intelligence files and case materials. Other agencies have equivalents: fraud investigation files at a revenue department, child welfare case notes, protective details in emergency management plans.

Criminal justice information carries specific requirements under the FBI’s CJIS Security Policy, including access control, audit logging and encryption, for agencies and contractors that access it. CJIS stands for Criminal Justice Information Services, the FBI division that runs national crime databases; its policy sets the security rules for anyone connecting to them. Compliance with that policy is necessary but does not stop copies spreading. Exports to spreadsheets, printed reports scanned back in, and working files on personal drives often live outside the systems the policy was applied to.

The policy applies to criminal justice agencies and to the private contractors that support them, which sign a security addendum. Each state’s CJIS Systems Agency audits compliance, typically every three years. Auditors look at access controls, authentication, logging and encryption around the systems that hold criminal justice information. They are less likely to find a spreadsheet of informant contacts on an analyst’s shared drive, because nobody listed that drive as a system that holds such information.

Other agencies, other rulebooks

Other operational data carries its own rules. State revenue agencies that hold federal tax information must follow the IRS’s Publication 1075 safeguards. Agencies that receive Social Security Administration data do so under data exchange agreements with security terms. Public health departments may be covered by HIPAA for some functions. Child welfare agencies hold case records protected by federal and state confidentiality laws. Each rulebook protects the primary system. None of them guarantees that copies stay inside it.

Shrinking the footprint

For the most dangerous records, segregation helps. Informant management, for example, can run in a dedicated system with a small number of named users, strong authentication and no export function by default. When an analyst needs a list, the system can produce one with fewer fields, for a stated purpose, logged and set to expire. Each safeguard adds a little friction. The trade-off is worth discussing openly with investigators, who are more likely to accept controls they helped design.

Partners’ data in your files

The D.C. release included intelligence material from federal partners. That is common. Police departments, fusion centers and other agencies hold information shared with them by the FBI, other federal agencies, neighboring jurisdictions and state partners. A leak of that material harms the partner as well as the agency, and information-sharing agreements may require prompt notice to the originator.

The longer-term cost is trust. A partner that sees its reports published on a criminal website may share less, or share later, with the agency that lost them. Agencies should know which partner data they hold, where it is stored, and whom they would need to call. That list belongs in the incident plan, alongside the notification matrix for residents.

The useful exercise is to trace where the most dangerous records actually end up, then shrink that footprint. That means asking analysts and investigators how they really work, not how the policy says they work, and then giving them safer ways to do the same job.

Detection belongs here, because this is the data an attacker most wants and the agency can least afford to lose. Exfiltration usually happens days before any visible attack. Monitoring for large or unusual outbound transfers, especially from file servers and records systems to cloud storage services, gives a chance to stop theft before the leak site appears. Many agencies watched closely for encryption behavior and barely at all for data leaving.

Several detection techniques are within reach of a mid-sized agency. Egress filtering restricts which outside services can receive data from sensitive servers. Data loss prevention tools flag files with patterns such as Social Security numbers leaving the network. Decoy files, sometimes called honeytokens, raise an alarm when anyone opens or copies them. Each produces alerts that someone must review, so a small agency may get more value from a managed detection service than from tools it cannot staff.

Data about the public: harm to residents

The third category covers victims, witnesses, applicants, taxpayers and benefit recipients. Disclosure triggers state breach notification laws, which require organizations to tell affected people when their personal information is exposed, and, depending on the data, other obligations. It also damages public trust in ways that affect cooperation with the agency for years. A witness who learns their statement was posted online may not come forward again.

For most agencies this is the largest and most dispersed category, spread across line-of-business applications, document management systems and email. Much of it is held by contractors and software providers, so the agency’s exposure includes its suppliers’ security. Contracts should require notice of a supplier incident within a defined period and cooperation in identifying affected residents.

Notification obligations by type of agency

The rules differ by level of government. Every US state has a breach notification law, and many apply to state and local agencies as well as businesses, though definitions and deadlines vary. Federal agencies follow breach response requirements set by the Office of Management and Budget, including a 2017 memorandum on responding to breaches of personally identifiable information. Data that agencies receive from federal partners often carries its own reporting terms in the sharing agreements. A county that holds residents’ data under three or four of these regimes needs a matrix, prepared in advance, showing which applies to which data.

Victims and witnesses need more than a notification letter. Where their safety may be at risk, the agency should contact them directly, through the investigator or victim services staff who know them, and offer practical help. A form letter is the wrong first contact for someone whose statement against a gang member has just been published.

Suppliers who hold residents’ data

Residents’ data often lives with companies the agency hired: court e-filing services, payment processors for utility bills and parking fines, platforms for permits and service requests, and cloud storage for body camera footage and other evidence. A breach at any of them can put the agency’s residents on a leak site. The MOVEit incidents of 2023, discussed below, showed how a single supplier’s software can expose many public bodies at once.

The contract is the agency’s main lever. It should set a deadline for notifying the agency of a suspected incident, measured in hours or days rather than “promptly.” It should require the supplier to share forensic findings, flow the same terms down to its own subcontractors, and pay or reimburse notification costs where the supplier was at fault. It should also require return or deletion of data when the contract ends. Many agencies inherit older contracts with none of these terms, so renewal dates are the natural moment to add them.

Collection is the other lever. Many agency forms still ask for Social Security numbers, dates of birth and full addresses where a case number or partial identifier would do. Each unnecessary field enlarges what a thief can publish and what the agency must notify about. A review of intake forms and database fields, asking whether each sensitive element is needed and for how long, is unglamorous work. It is also one of the few controls that reduces harm even after every other defense has failed.

The retention tension

Deletion is harder for a public agency than for a company. State records laws and archival schedules require many records to be kept for set periods, some permanently. Pending litigation and public records requests can freeze deletion. Agencies cannot simply decide to keep less. They can, however, enforce the schedules they already have. Many backlogs consist of records whose retention period expired years ago, kept because nobody was assigned to approve their destruction. That backlog is the safest place to start.

Mapping the harm: a practical exercise

The three categories are more than a filing system. They give an agency a way to run a short, useful exercise without any specialist tools.

Start with a table. Down the side, list the agency’s main collections of data: the HR system, payroll, the records management system, case files, shared drives, email, and each major application that holds information about residents. Across the top, put the three categories: workforce, operational, public. In each cell, record three things: what sensitive information is there, who would be harmed if it were published and how badly, and who owns the decision to keep, move or delete it.

Then add two columns that most agencies find uncomfortable. The first is “copies”: everywhere else the information ends up, through exports, reports, attachments and working files. The second is “oldest record”: how far back it goes, and whether there is any reason to keep the oldest material.

The exercise tends to reveal the same patterns. The most dangerous information is rarely confined to the system designed to protect it. Large amounts of old data are kept for no reason anyone can name. Some collections have no clear owner at all. And a surprising share of residents’ data sits with suppliers rather than on the agency’s own systems.

These findings rarely require a large budget to address. Each points to a specific action: delete the old material, close off the risky copies, assign an owner, tighten the supplier contract. The value of the exercise is that it turns a vague fear, “we might be hacked,” into a short list of concrete decisions. Each is tied to a group of people who would otherwise be hurt.

Scoring and sequencing

A simple scale helps the table drive decisions. For each cell, rate the harm of publication: physical danger to a person, serious financial or legal harm, embarrassment and loss of trust, or little harm. Then rate how exposed the data is: confined to one well-controlled system, copied to a few known places, or scattered. Start with the cells that combine physical danger and wide exposure. In a police department, that usually means informant and witness information. In a social services department, it may mean case notes on children and domestic violence survivors.

The exercise does not need consultants. Two half-day workshops, with the records officer, the privacy lead, a senior investigator or program manager, HR and IT, will produce a usable first version. The table should then be revisited each year, and whenever a major system is added or retired.

Two tracks: recovery and disclosure

The response plan needs a disclosure track alongside the recovery track. The recovery track is the familiar one: isolate infected machines, restore from backups, get services running. The disclosure track is about the data that has already left.

Someone must assess what was taken and whose it was, and decide on notifications under each applicable law. Someone must prepare call center scripts and decide how the agency will respond publicly to a leak site posting. Those roles sit with legal, privacy and communications as well as IT. Agencies that rehearse ransomware only as a restoration exercise leave this track untested.

Who does what in the first week

The disclosure track has a predictable sequence. Counsel retains a forensic firm, often through the agency’s cyber insurer where one exists, so the investigation runs under legal advice. The forensic team works out what was accessed and copied, using logs and the attacker’s own samples. The privacy lead maps affected data to people and to notification laws. Communications prepares statements and call center scripts. Investigators and victim services contact people at physical risk directly. The agency also briefs the FBI and, where relevant, the state fusion center or CISA, and keeps them updated as it learns more.

Informants need a protocol of their own. Each handler reviews whether any of their sources could be identified from the stolen material, even indirectly through dates, locations or case details. Sources at risk are contacted in person or through a safe channel, and the agency decides what protection or support it can offer. Prosecutors are told which cases rely on those sources, because a compromised informant can change how a case proceeds. This work is slow and confidential, and it should start on the first day.

Leadership decides on payment, on public statements and on any request to the courts or service providers to remove published data. Takedown efforts rarely remove data from criminal sites entirely, and public statements should avoid drawing attention to where the files can be found.

Suppose that on a Tuesday morning a reporter calls a county’s press office: a criminal group has listed the county on its leak site, with sample files from the sheriff’s office and the social services department. The county’s systems are all working normally. The IT team’s ransomware runbook, built around restoring encrypted servers, has nothing to say.

The temptation in that moment is to treat the problem as an IT incident: hunt for the intruder, check the backups, reassure everyone that systems are secure. All of that is worth doing, and none of it answers the reporter’s question, which is about whose information is now public.

The questions that follow are not technical: which files are in the sample and what else might have been taken; which employees, residents and informants are affected; which notification laws apply, and by when; who speaks to the press, and what they say; and who tells the sheriff’s deputies before they read about it. If the county has rehearsed this scenario, each question has an owner and a starting answer. If it has not, the county spends its first days working out who is in charge while the criminal group sets the pace.

Two practical details make the disclosure track work. First, decide in advance who may look at the leak site and download the published files, since reviewing them is necessary to know who was affected but involves handling stolen, sensitive material. Counsel and law enforcement should agree the approach. Second, prepare holding statements now: short, honest public messages for employees, residents and the press that can be adapted in hours rather than drafted from scratch under pressure.

Rehearsal does not need to be elaborate. CISA publishes tabletop exercise packages that agencies can adapt, including ransomware scenarios. Adding a leak site posting to an existing exercise, with a reporter’s call as the first inject, tests the disclosure track at almost no extra cost. The exercise is most useful when the agency head and the public information officer take part, because the hardest decisions belong to them.

Small agencies and shared help

A small town’s police department or a rural county rarely has a privacy officer, a forensic retainer or a communications team. It may rely on county or state IT and on outside help. The Multi-State Information Sharing and Analysis Center, which serves state, local, tribal and territorial governments, provides threat information and incident support. Some states have created cyber response teams to assist local governments. The time to learn how to call on them, and what they can and cannot do, is before an incident.

Cyber insurance is another source of help, and for many local governments it comes through a public entity risk pool rather than a commercial policy. Coverage often includes forensic firms, breach counsel and notification services from an approved panel. Insurers have also tightened their requirements, commonly asking for multi-factor authentication, tested backups and endpoint detection before they will renew. An agency should read its policy now to learn what it requires and what help it provides.

A problem for the agency head before the help desk

For an elected official, a city manager or an agency head, data extortion is a leadership problem before it is a technical one.

• People are at risk. Informants, officers, victims and witnesses can face real danger if their information is published. That is a duty of care as much as a compliance matter.
• The mission is at risk. Investigations can collapse and sources can dry up. A child welfare service whose case notes leak may find families less willing to engage.
• Costs are real. Notification, credit monitoring, call centers, legal advice and investigation all cost money, often far more than the security measures that would have reduced the exposure.
• Trust is slow to rebuild. Residents judge an agency by how it treated their information and how honestly it explained what happened.
• The payment decision is political. Public agencies face scrutiny, legal limits and possible sanctions on paying, and a payment for stolen data buys only a promise. Leaders should settle their stance in calm conditions, not during the crisis.

The case for putting backups first

The strongest objection to this article’s argument is that encryption remains the more urgent threat for public services. A 911 dispatch center, a jail management system or a court docket that stops working endangers people within hours. Colonial Pipeline, days after the D.C. leak, showed what encryption alone could still do. On this view, agencies with limited budgets should finish the recovery job first.

The objection is right about priorities for critical services and wrong about the trade-off. Most disclosure controls cost little money: enforcing retention schedules, trimming intake forms, assigning data owners, rehearsing statements. They compete with recovery work for attention more than for budget. An agency can do both, and the D.C. case showed what happens to one that does only the first.

Habits of the agencies that were ready

Agencies that are well placed share a few habits. They know where their most sensitive workforce, operational and public data lives, including the copies. They delete what they no longer need, on schedule, with someone authorized to do it. They collect less in the first place. They watch for data leaving as closely as for systems locking. Their contracts require suppliers to report incidents promptly. And they rehearse both tracks of the response, with legal, privacy and communications in the room alongside IT.

They also measure progress in terms leaders can follow. Useful measures include the share of file shares and databases with a named owner, and the volume of records past their retention period. Two more are the time taken to detect a simulated large upload in testing, and the date of the last exercise that included a leak scenario. Each measure maps to one of the habits above, and each can be reported to an agency head or council in a single line.

The unprepared agencies show the reverse. Treating good backups as the whole ransomware strategy. Keeping everything forever because deletion feels risky. Assuming CJIS compliance means the sensitive data is contained. Ignoring HR and payroll systems because they are not “mission” systems. And leaving the decision on whether to pay, and how to talk to the public, until the leak site is already live.

What to settle before a leak site names you

1. If someone copied our files today, which ones would cause the most harm if published, and to whom?
2. Where are the copies of our most sensitive records: spreadsheets, scans, personal drives, email?
3. Would we notice a large transfer of data leaving our network to a cloud storage service, and how quickly?
4. Who owns the disclosure track of our ransomware plan, and when did we last rehearse it?
5. What is our position on paying for stolen data, and who has agreed it?

With hindsight

Extortion based on stolen data, with or without encryption, became standard criminal practice, and the D.C. incident now looks like an early marker of that shift. Babuk’s 2021 announcement that it would stop encrypting and focus on publishing data turned out to describe the direction of the whole criminal market.

Babuk itself did not last long in its original form. In September 2021 its source code was leaked on a criminal forum, and other groups went on to build ransomware from it. The brand mattered less than the method, and the method spread.

The attack on the D.C. police also came back into the courts. In May 2023 the Justice Department unsealed charges against a Russian national, Mikhail Matveev. It accused him of taking part in attacks using the Babuk, LockBit and Hive ransomware strains, including the April 2021 attack on the Metropolitan Police Department. The Treasury Department sanctioned him the same day, and the State Department offered a reward for information. He was believed to be in Russia, beyond the reach of US courts. Charges and sanctions raised the cost for individuals, but they did not undo the leak.

The clearest case of data-only extortion came in 2023. The Clop group exploited a flaw in the MOVEit Transfer file-sharing product to steal data from a very large number of organizations, without deploying ransomware at all. MOVEit is software organizations use to send large files securely to partners and suppliers; a single weakness in it gave the attackers a doorway into many victims at once. State agencies, including motor vehicle departments in Oregon and Louisiana holding records on millions of residents, were among those affected. No systems were locked. The harm was entirely about what had been copied.

The payment logic described above was borne out. After the February 2024 attack on Change Healthcare, a unit of UnitedHealth Group, the company confirmed it had paid a ransom to protect patient data. A second criminal group later claimed to hold the data and demanded payment of its own. A payment had bought no certainty about where the stolen files went.

Policy moved, unevenly. In 2022 North Carolina and Florida barred state agencies and local governments from paying ransoms. In 2023, governments in the international Counter Ransomware Initiative issued a statement that their central governments should not pay. Congress passed the Cyber Incident Reporting for Critical Infrastructure Act in 2022, which will require covered entities to report significant incidents and ransom payments to CISA once its implementing rule takes effect. CJIS security policy was also modernized, with multi-factor authentication requirements for access to criminal justice information.

Law enforcement had real successes against the groups themselves. The FBI disrupted the Hive operation in January 2023, and an international operation took down LockBit’s infrastructure in February 2024. Those actions bought victims time. Affiliates, the criminals who rent ransomware and carry out attacks, moved to other brands.

Law enforcement agencies continued to be targeted, and cities kept learning the same lesson. Ransomware attacks on Oakland and Dallas in 2023 combined service disruption with data theft. Many agencies improved backup and recovery after 2021, which reduced the pressure encryption alone could apply, and attackers leaned harder on disclosure. Better backups did not end extortion; they changed its shape.

Workforce data proved as sensitive as this article suggests, even without criminals involved. In August 2023 the Police Service of Northern Ireland mistakenly published a spreadsheet containing the surnames and initials of all its officers and staff, in response to a freedom of information request. The UK Information Commissioner later fined the service. The episode showed how quickly a disclosure of names and roles becomes a safety problem for police.

Ransomware resilience now has two halves. The first, being able to restore systems, is well understood and widely funded. The second, limiting what can be stolen and being ready to handle its release, is less mature in many organizations and depends more on everyday disciplines than on technology: deleting old records, collecting less, knowing where copies live, holding suppliers to account and rehearsing the public response.

Agencies that know where their workforce, operational and public data live, and how long they keep it, can make faster decisions when a leak site names them. They can tell employees and residents what was exposed, meet notification deadlines and speak publicly with some confidence. Agencies that do not are left guessing, while the attackers decide what the public learns and when.