Uncle Henry’s Inc.
Uncle Henry’s database extortion attack
Summary
Attackers deleted Uncle Henry’s website database March 11, 2025, taking its classified-advertising service offline until April 10. The company disclosed the hack March 12. Reporting described a roughly $700 Bitcoin demand and a small sample of copied ads, without establishing encryption or theft of the full database.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing. -
Incident end:
?
Confirmed or defensibly assessed end of material operational disruption or incident activity.
Primary victim organization
Impacted location
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Data extortion
Threats to publish or sell stolen data without evidence of encryption.
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data deletion or destruction
Data was intentionally deleted, wiped, destroyed, or made permanently unrecoverable.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Complete service outage
A primary service, system, platform, or operational capability became entirely unavailable.
-
Website unavailable
A public-facing website was unavailable, disabled, or inaccessible.
Extortion indicators
-
Ransom demand
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
-
Data-theft extortion
The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.
-
Direct victim contact
The actor directly contacted the victim through a ransom note, email, chat portal, telephone call, messaging platform, or other communication channel.
Incident narrative
Analyst assessment
Uncle Henry’s disclosed March 12, 2025, that its classified-advertising website had been hacked and its database deleted. The company said forensic IT consultants were helping it evaluate restoration and rebuilding options. The direct acknowledgment and loss of its online service support a confirmed cyberattack assessment with high confidence.
Operational significance
The publisher’s website was unavailable after the March 11 attack. Its April 10 announcement said the service was back, recoverable data had been restored and traces of the attackers had been removed. The operational status is resolved, with April 10 as the documented website recovery date. That milestone does not mean the entire historical database was recovered.
The outage interrupted the publisher’s main channel for connecting buyers and sellers after it had ended print publication in 2024. That earlier business decision preceded the attack. Augusta is the company’s verified physical location; no citywide or countywide disruption is asserted.
Confidence and uncertainty
The Portland Press Herald’s April 15 report quoted President Kevin Webb and freelance technician Bradley Corson. It dated the deletion to March 11, with discovery the next morning, and described a demand for about $700 in Bitcoin. The demand is not an amount paid or a measure of business losses.
According to that report, specialists considered it a scam in which attackers copy a small sample and delete the remaining database. Webb said the attackers could show only a few copied advertisements when asked for proof of their broader theft claim. Most active advertisements and user data were recovered, while historical material was lost. The reporting does not establish encryption, a particular malware family or theft of the full database.
Analytic gaps
Webb said sensitive information such as credit card data had not been exposed and described the available information as email addresses and ad content. This is an attributed company finding, not independent forensic verification that no user information was accessed. No named actor or matching public ransomware listing was found in canonical-name, domain or supported-alias searches.
The reviewed original sources do not establish the entry route, complete forensic findings, final recovery costs or payment outcome. Our Ghost article says the company refused to pay; that detail is not independently verified in the original reporting reviewed here and is not adopted as a confirmed payment finding.
Organizations involved
Impacted location
Augusta, Maine
Company physical headquarters at525EasternAve, verified in its officialreciprocalFacebookprofile and exactCensusaddress matchAugusta2302100/Kennebec23011. Organization place anchor; no citywide outage or proof of server hosting here.
Sources
We reported database deletion, a Bitcoin demand and restoration of the classified-advertising website.
The publisher confirmed a hack and database deletion and said forensic IT consultants were assisting restoration and rebuilding.
The company said its site was back after the hack, it had recovered what it could and removed traces of the attackers.
Named company officials described March11 database deletion, a roughly$700Bitcoin demand and April10 website restoration.
See something that needs correction?
Signed-in members can report an error, update, or missing source.