Hackers threaten to leak Cobb County records
Add Axios as your preferred source to
see more of our stories on Google.
/2025/05/02/1746216384406.gif?w=3840)
Illustration: Tiffany Herring/Axios
A ransomware group says it plans to release employee records, autopsy photos and sensitive personal information it claims to have accessed from a Cobb County government data breach.
Driving the news: On Thursday, a hacking group named Qilin posted on its data leak site that it collected 400,000 files totaling 150 gigabytes. It planned to publish the data in 48 hours.
- The hacking group's post included unedited sample images of apparent autopsy photos, copies of driver's licenses and forms listing people's Social Security numbers, according to a dark web listing seen by Axios.
Caveat: Axios is unable to verify the legitimacy of the images.
Catch up quick: On April 24, Cobb government officials said 10 individuals, including three county employees, were affected by a cybersecurity breach.
- "We are providing these individuals with guidance on how to protect themselves, and, in select cases, we are providing identity theft protection and credit monitoring if their case involves certain types of information," the county said in a statement.
- At the time, the county did not release specific details about what data was accessed and how. It's unclear if the documents Qilin claims to have are from that breach.
What they're saying: On Friday, the county said it had not confirmed the accuracy of social media reports about a "cybersecurity incident" and would "not speculate on information allegedly found on obscure parts of the internet."
- The county said a "third party" contacted officials after a recent cyberattack to demand a ransom. The county declined.
- "We refuse to support or enable criminal enterprises, even when faced with difficult choices," the statement said. "While we understand this may offer limited comfort to those affected, standing firm sends a clear message: Bad actors will not profit from this crime."
Zoom in: According to Comparitech, Qilin is based in Russia and licenses its malware to other actors who want to launch ransomware attacks. The group takes a 15% to 20% cut of the proceeds, the Guardian reports.
Axios' Sam Sabin contributed reporting