The Payne County Sherriff’s Office in Oklahoma this week confirmed it was hit by a ransomware attack last month.
One June 3, 2025, the Sheriff’s Office announced that anyone who filed a report prior to May 15 should monitor their credit reports and bank accounts, issue fraud alerts, and change passwords.
“The cyberattack has had no impact on the office’s critical function of providing public safety services to the residents of Payne County. The process of restoring the internal IT system at the Payne County Sheriff’s Office continues,” says the announcement on the Sheriff’s website.
Ransomware gang SafePay took credit for the attack on May 28, saying it stole 8 GB of data from the Sheriff.
The Sheriff’s Office has not verified SafePay’s claim. We do not yet know what data might have been compromised, how much SafePay demanded, if Payne County did or will pay a ransom, or how attackers breached the county’s network. Comparitech contacted the Payne County Sheriff’s Office for comment and will update this article if it replies.
Who is SafePay?
SafePay is a relatively new ransomware gang that first started adding targeted organizations to its data leak site in November 2024. It employs a double extortion scheme in which SafePay both steals and encrypts data.
SafePay took credit for more attacks than any other ransomware group in May 2025, claiming responsibility for 71 attacks. Since it started, the group has claimed 27 confirmed attacks and 183 unconfirmed claims in total.
SafePay has successfully attacked three other government entities:
- Barbados Statistical Service – October 2024
- Muswellbrook Shire Council, Australia – December 2024
- Gemeinde Kirkel, Germany – March 2025
Earlier this week, Compassion Health Care confirmed it notified 23,000 people of a data breach claimed by SafePay in March 2025.
Ransomware attacks on US government
Comparitech researchers have logged 29 confirmed ransomware attacks and 29 unconfirmed claims against US government entities.
In another recent attack, unknown attackers breached Liberty Township, OH last month. This week, Clark County, WA also began notifying 76,000 people after an October 2023 ransomware attack.
Ransomware attacks on US government agencies and departments can both steal data and lock down computer systems. The attacker then demands a ransom to delete the stolen data and in exchange for a key to recover infected systems. If the target doesn’t pay, it could take weeks or even months to restore systems, data could be lost forever, and people whose data was stolen are put at greater risk of fraud.
About the Payne County Sheriff’s Office
Headquartered in Stillwater, Oklahoma, the Payne County Sheriff’s Office is headed by Sheriff Joe Harper. Payne County is home to about 82,000 people northeast of Oklahoma City.
