A cybercriminal group called SafePay yesterday took credit for an April 2026 cyber attack at the Harrison County Commission in West Virginia.
The commission on April 23, 2026 said a cyber attack hit its systems. The attack forced the commission to turn away people from the county courthouse on the following day when they tried to pay their property taxes. Systems were mostly restored more than a week later, but some were still down as of May 6.
SafePay claimed responsibility for the breach on May 18, 2026. On its data leak site, SafePay gave the commission three days to pay an undisclosed amount in ransom for data the ransomware group says it stole during the attack.
The Harrison County Commission has not acknowledged SafePay’s claim and Comparitech cannot independently verify it. We do not know how many people’s data was compromised, how attackers breached the commission’s network, if the commission did or will pay a ransom, or how much SafePay demanded. Comparitech contacted the commission for comment and will update this article if it replies.
“More computers are back online across County operational centers, and all offices remain functional and able to serve our community,” says the county’s May 6 media update.
“We do recognize that certain administrative reporting functions within the Sheriff’s Office have been impacted, creating temporary challenges.”
The commission said public safety and election integrity remain intact.
Who is SafePay?
SafePay is a ransomware gang that started adding targeted organizations to its data leak site in November 2024. The group uses LockBit-based ransomware. It employs a double-extortion scheme in which a ransom is demanded to restore systems and to delete stolen data.
SafePay has taken credit for 479 ransomware attacks since it began. Of those, 68 were confirmed by the organizations SafePay targeted.
The group has claimed responsibility for 12 data breaches reported by US government entities. In February, it took credit for an attack on German utility provider Abfallentsorgung Kreis Kasse.
In 2026 to date, SafePay has claimed credit for 56 attacks, six of which have been confirmed.
Ransomware attacks on US government
Comparitech researchers have logged 21 confirmed ransomware attacks on US government entities in 2026 so far. Last month’s attack claims include:
- Winona County, MN reported a data breach claimed by Interlock
- Kent District Library reported a data breach claimed by Interlock
- The city of Ardmore, OK said it refused to pay a $300,000 ransom demand from an unnamed attacker following a data breach
- Adams County, MS said it refused to pay a ransom to unnamed attackers
It often takes several months for government entities to official notify breach victims. In the last few weeks, we’ve confirmed the following attack claims:
- Winona County, MN notified 6,196 people of a January 2026 ransomware attack, its first of two data breaches this year
- Suffolk, VA notified 157,725 people of a February 2026 data breach claimed by Cloak
- MassDevelopment (MA) reported a March 2026 data breach claimed by DragonForce
- Gainesville-Alachua County Regional Airport Authority notified 2,141 people of an October 2025 data breach claimed by Qilin
Ransomware attacks on US government agencies and departments can both steal data and lock down computer systems. The attacker then demands a ransom to delete the stolen data and in exchange for a key to recover infected systems. If the target doesn’t pay, it could take weeks or even months to restore systems, and people whose data was stolen are put at greater risk of fraud. Ransomware can disrupt everything from communications to billing, payroll, access to data and applications, and online services.
About the Harrison County Commission
Harrison County is home to about 65,000 people in north-central West Virginia. The county seat is Clarksburg. The Harrison County Commission is headed by three elected commissioners who serve as the county’s chief governing body. The commission is responsible for maintaining infrastructure and protecting public safety, among other responsibilities.
