After a cyber attack on Morgan County 911 in May 2025, ransomware gang Qilin came forward to claim the attack last night. It uploaded various documents as part of its proof pack, including what appear to be financial records.
On May 14, Morgan County 911 suffered a cybersecurity incident which disrupted administration systems for several days. Crucially, however, dispatch functions, such as radio communications, call history, and CAD systems, were not affected. But as a precaution, the Sheriff’s Office network was disconnected from the 911 system, which left it without access to the Inmate Roster until May 20, 2025.
Comparitech contacted Morgan County 911 about Qilin’s claim and Director Jeanie Pharis provided us with the following statement:
As you know this article published has caused more issues we were hoping to avoid. We had kept the attack very quiet until now. No critical systems were ever affected. Our ability to operate as a 911 Center was never hindered and our operations remain intact. This was not a phishing incident, more of brute force. Their claims are grossly misrepresented. I cannot speak on other specifics other than confirm it was Qilin.
Comparitech also asked how many people may be affected by this incident and whether or not a ransom was demanded and/or paid and we will update this article if we receive any further details.
Who is Qilin?
Throughout 2025 so far, we’ve seen 50 confirmed attacks via this group with 13 of these being on government entities. We are also tracking 323 unconfirmed attacks from this group this year so far–four of which are on government entities.
Its most recent attacks, in June 2025, were carried out on the City of Green River in the US and Ciudad Autónoma de Melilla in Spain. In Melilla’s case, the ransom demanded is alleged to have been €1.8 million ($2.12M USD) which the city refused to pay. The attack started on June 22, 2025, with most systems being back to normal as of July 16, 2025.
Meanwhile, this month, French manufacturing company WIBAIE was hit by a Qilin attack, bringing the factory to a standstill and leaving 600 employees unable to work. Covenant Health also began notifying over 7,800 people of a data breach following an attack via the group in May 2025.
Qilin is a Russia-based group, operating as a ransomware-as-a-service business in which affiliates are paid to use the group’s ransomware to launch attacks on companies to try and secure ransom payments.
Ransomware attacks on US government agencies
So far this year, we’ve noted 44 confirmed attacks on US government organizations and are monitoring a further 33 unconfirmed.
Other recently confirmed attacks include:
- City of Durant, OK: targeted by INC in June 2025. INC alleged to have stolen 800 GB of data from the city
- Appalachian Regional Commission, DC: hit by Medusa in April 2025 with a ransom demand of $500,000. The commission recently notified 937 people of the breach
- Massachusetts Municipal Wholesale Electric Company (MMWEC): started to issue data breach letters this week following an attack in January 2025. BlackSuit, whose website was seized by law enforcement yesterday, claimed this attack
- Town of North Providence, RI: began notifying 1,800 people of a data breach this week after suffering an attack in May 2025. Medusa also claimed responsibility for this, issuing North Providence with a ransom of $100,000
As our H1 2025 report recently found, government organizations have become an increased target for ransomware groups with a 60 percent increase in attacks from H1 of 2024 to H1 of 2025. These attacks often cause huge disruption both in the encryption of systems and the theft of data.
While we await further confirmation from Morgan County 911 on any potential data breaches stemming from this attack, we highly recommend citizens and employees remain on high alert for any phishing messages and monitor accounts for any suspicious activity.
About Morgan County 911
Situated in Decatur, Alabama, Morgan County 911 deals with all emergency calls from Morgan County and its surrounding municipalities, dispatching these to 25 fire and rescue agencies, seven police departments, and one ambulance service.
