Interlock

Interlock’s branded leak page names Southeastern Oklahoma State University and se.edu and claims a 710 GB collection containing 171,499 files and 19,366 folders. The group alleges the collection includes student names, contact information, Social Security numbers, grades, enrollment and financial-aid data, disciplinary and medical information, Forms 1095-C, more than 490 documents, records tied to more than 90,000 students, and employee identity, injury, Medicare and child-custody or consent information. The page shows document thumbnails and a “GET” button. A separate screenshot shows a directory listing with 11 folders and their stated sizes. The images document what Interlock claimed to possess and presented as available through its site. They do not establish that the files are authentic, originated from the university or were downloadable in full. The university has not confirmed data theft, ransomware or Interlock’s involvement.

A confidential source working inside AnMed provided a photograph of a ransom demand displayed on a hospital screen, including a victim-specific Tor address for a negotiation chat server and a unique access code used to establish a negotiation account. The Tor address resolved to infrastructure associated with Interlock. The ransom note claims encryption and data theft, imposes a 72-hour deadline and threatens publication, but the visible text does not identify either AnMed or Interlock by name. The victim-specific negotiation infrastructure provides substantive evidence supporting medium-confidence attribution to Interlock.

That assessment is complicated by later, materially conflicting evidence. The Gentlemen subsequently listed AnMed on its leak site, and Gentlemen-branded messages were posted through AnMed’s compromised social-media accounts. AnMed’s Aug. 27 notice says a virus locked access to network files and files on certain systems were copied without permission, but it does not identify a threat actor or establish the encryption implementation.

The Tor address and negotiation code are withheld to protect private victim communications.

Interlock claimed the District of Columbia Housing Authority on its leak site. Daily Security Review reported the listing, and BreachSense reported a claimed 1,660 GB volume. DCHA confirmed only that a limited subset of data including sensitive information was compromised; it did not confirm Interlock, the claimed volume, data theft, ransomware encryption or a demand.

External threat-intelligence reporting says Interlock claimed responsibility on May 11, 2026 and threatened release of allegedly stolen data; KDL has not publicly confirmed the attribution in reviewed sources.

Interlock publicly claimed the April 2026 attack and posted purported samples, but Winona County did not name the group and the reporting outlet could not independently verify attribution or the claimed file volume.

Interlock listed Community College of Beaver County and claimed it stole 780 GB and published records. CCBC later confirmed unauthorized access and that an unauthorized party obtained information, but it did not attribute the incident to Interlock or corroborate the group’s claimed data volume or publication. The claim supports low-confidence attribution, not proof of actor responsibility or the provenance and completeness of material Interlock presented.

Interlock listing carried an incorrect Pennsylvania affiliate label, but reviewed materials appeared to identify Goodwill Industries of Greater Grand Rapids. Treat as an attribution claim, not confirmed responsibility.

Interlock listed Wagon Mound Public Schools and claimed it obtained about 80 GB of staff and student information. The district confirmed malware and operational disruption but has not corroborated Interlock, ransomware or data theft.