Union County ransomware attack exposed residents' personal information, county says

Social Security numbers and driver’s license numbers tied mostly to Union County law enforcement, court matters and other county business may have been exposed in a ransomware attack on the county government network, and residents were urged to check bank and account statements for suspicious activity.

Union County said it detected the ransomware on March 13, then determined by March 17 that cybercriminals had taken data from its system. Public notice followed on March 21, after officials said they needed to complete a review to identify exactly what information was involved, who was affected and where those people live so written notices could be sent under Pennsylvania law.

The county said it notified federal law enforcement and the Union County District Attorney, and it hired nationally recognized third-party cybersecurity and data-forensics consultants. Officials said the affected information appears to be concentrated in county law enforcement files, court-related records and other county business.

Union County said the stolen data may contain Social Security numbers and driver’s license numbers. Because of that risk, the county said it would offer complimentary credit monitoring where appropriate and send written notice to affected individuals after the review was finished.

County officials also said they had already deployed new security tools, increased endpoint monitoring, completed an enterprise-wide password reset and tightened restrictions on external network access. As of March 24, no ransomware gang had publicly claimed responsibility for the attack.

Preston Boop, the county commissioner chair, said the privacy and security of information is very important as officials worked through the fallout. Union County has more than 40,000 residents, and the incident left open questions about whether any county services or records access were disrupted and how long full restoration would take.

For people in Lewisburg and across the county, the most immediate step is to watch for unfamiliar charges, bank withdrawals or account changes and to act quickly if anything looks wrong. The county said its written notices and credit monitoring will go to people it identifies as affected once the review is complete, but the breach has already put routine personal records and financial safeguards at the center of county concern.