Cyber Incident Victim: Southampton County
Date:
Sep 2022
Location:
United States of America
Summary
A Virginia county experienced a ransomware attack where threat actors breached a server, encrypted stored data, and potentially accessed sensitive personal information including names, addresses, driver’s license numbers, and Social Security numbers. The attackers, later identified as the LockBit 3.0 gang, claimed responsibility and posted a stolen W-2 form online while advertising access to additional data for a ransom. Although the county found no conclusive evidence of data exfiltration beyond the W-2, it notified affected individuals and offered free credit monitoring as a precaution. The gang’s leak site displayed folder names from the compromised systems alongside options to purchase data destruction or download capabilities.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Southampton County, Virginia, identified a ransomware attack in September 2022 when an unauthorized actor accessed a county server and encrypted stored data. The county implemented immediate containment measures upon discovery and initiated an investigation to assess potential data compromise. Forensic analysis determined that personal information—including names, addresses, driver’s license numbers, and Social Security numbers—residing on the affected server was at risk of exposure. While no definitive evidence confirmed data exfiltration, the county proactively notified impacted individuals via mailed letters submitted to the Montana Attorney General’s office. These notifications, sent in November 2022, offered complimentary credit monitoring services as a precautionary measure. The compromised server contained archived county records, though specific departmental systems or operational infrastructure beyond this server were not detailed in public disclosures.
The LockBit 3.0 ransomware group claimed responsibility for the attack, advertising it on their Tor-based leak site in September 2022. Their post included screenshots displaying folder names allegedly stolen from county systems and featured two interactive options: a “destroy all information” button and a “download data at any moment” button, both priced at $90,000. Southampton County confirmed partial data theft after a single W-2 form appeared on dark web platforms, with attackers asserting broader exfiltration of sensitive data from the encrypted server. No evidence suggested additional leaks beyond this W-2 form at the time of public reporting. The county completed recovery efforts prior to the dark web disclosure but maintained ongoing monitoring for further data exposure.