The town of Apex, North Carolina yesterday confirmed it notified 22,601 people of a June 2024 data breach that compromised the following personal info:
- Names
- Social security numbers
- Government-issued ID numbers (e.g. driver’s license, passport)
- Financial account info
- Credit and debit card numbers
- Email addresses
- Usernames
- Passwords
- Dates of birth
- Dates of service
- Health insurance info
- Medical conditions and treatments
- Medical record numbers
- Patient account numbers
- Phone numbers
- Info related to your relationship with Apex (e.g. employee or volunteer)
Town officials at the time said the breach resulted from a ransomware attack, but that no ransom was paid. No ransomware groups publicly took credit for the breach.
The stolen data was published on Bublup, a cloud storage provider. Apex secured a court order to access the stolen data.
In addition to the data breach, the attack disrupted bill payments for town residents.
Apex officials have not disclosed how attackers breached its network, how much they demanded in ransom, or why it took nearly two years to formally notify victims. Comparitech contacted Apex city hall for comment and will update this article if it replies.
“On July 2, 2024, we discovered irregularities in the Town’s network systems,” says the city’s notice to breach victims.
“The investigation determined that the Incident was the result of a ransomware event, and that unauthorized actors accessed the Town’s systems from June 23, 2024, through July 2, 2024. During this period of time, unauthorized actors may have accessed or acquired your Information without authorization.”
Ransomware attacks on US government
In 2024, Comparitech researchers logged 96 confirmed ransomware attacks on government entities in the USA. Those attacks compromised more than 2.6 million personal records. The year after, we tracked 86 such attacks compromising 645,000 records. And in 2026 to date, we’ve so far logged 10 confirmed attacks on US public entities.
Some other recently confirmed attacks in this category include:
- Meriden, CT reported a February 2026 data breach claimed by Inc Ransomware
- Warren County Sheriff’s Office (KY) reported a December 2025 data breach claimed by RansomHouse
- Mission, TX notified 12,443 people of a February 2025 data breach claimed by Qilin
- Peabody, MA notified 49,976 people about a June 2025 data breach claimed by Interlock
- Carthage, TX notified 8,517 people about a December 2024 data breach claimed by Rhysida
Ransomware attacks on government entities can both steal data and lock down computer systems. They can disrupt any number of government systems from bill payments to court records and even emergency dispatch. Governments must pay a ransom for the stolen data and to restore systems, or else they face extended downtime, permanent data loss, and putting data subjects at increased risk of fraud.
About Apex, NC
Apex is a town that spans Wake and Chatham Counties in central North Carolina. It’s home to about 60,000 people.
