INC Ransom adds two U.S. cities to its leak site; Acworth confirms cyberattack while Oak Park claim remains unverified

INC Ransom has added the City of Acworth, Georgia, and the City of Oak Park, Michigan, to its dark web leak site.

There are two very different situations:

• Acworth has publicly confirmed it experienced a cyberattack beginning on June 8. The city says it brought in cybersecurity specialists, notified law enforcement, restored affected systems, and that municipal services continue to operate normally.
• Oak Park has not publicly acknowledged any incident. Its appearance on the leak site is currently only the ransomware group's claim and has not been independently verified.

INC Ransom is known for double-extortion attacks, where data theft accompanies system encryption. Municipal governments remain attractive targets because they store large amounts of sensitive resident information while often operating with limited cybersecurity resources.

One thing worth noting is the distinction between a ransomware group's leak-site post and a confirmed breach. Leak-site listings can sometimes be verified quickly, while in other cases organizations deny or continue investigating the claims.

How should local governments communicate these incidents? Is it better to disclose suspected attacks early, or wait until investigators confirm exactly what happened?