Wexford ransomware disrupts services and damages land records

Malware that encrypts systems or data, typically accompanied by a ransom demand.

Unauthorized access to systems, accounts, networks, or data.

Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.

Data was intentionally deleted, wiped, destroyed, or made permanently unrecoverable.

Data became damaged, inconsistent, unreadable, or unreliable as a result of malicious activity or incident-related system effects.

Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

A service, system, platform, or operational capability remained available only in part or with significant limitations.

Internal or external network connectivity was unavailable or materially impaired.

The organization lost or materially restricted internet connectivity.

Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.

Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.

A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.

Internal business, administrative, operational, or staff-facing systems were unavailable.

A specific application or software platform became unavailable or unusable.

A database or data-management system became unavailable or inaccessible.

Business, financial, customer, administrative, or operational transactions could not be completed normally.

Staff, customers, patients, students, residents, or other users could not access records or case information normally.

The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.

Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.

Services continued but with longer processing, response, delivery, or completion times.

The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.

Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.

Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.

The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.

The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.

The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.

The actor directly contacted the victim through a ransom note, email, chat portal, telephone call, messaging platform, or other communication channel.