Interlock

Interlock’s branded leak page names Springfield Public Schools/springfieldpublicschools.com and claims1280GB,93377files and8735folders with student/staff records. Existing screenshot and fresh name/domain ransomware.live searches document the claim, not independently authenticated quantities/provenance. DistrictSept24FAQ confirms investigators reported stolen data releasedSept15 but does not nameInterlock or confirm actual encryption. Actor attribution remainslow.

Interlock’s branded leak page names the City of Fort Smith and fortsmithar.gov and claims a 5,720 GB collection containing 4,882,956 files and 326,671 folders. It alleges law-enforcement data, more than 100,000 Social Security numbers, police records, mobile-device records, water-system information and 911 call data. The screenshot documents the claim but does not establish the files’ authenticity or provenance. The city subsequently confirmed data theft and publication and a ransom demand, but has not confirmed encryption or Interlock’s involvement. The claimed categories, quantities and provenance remain unverified.

Interlock’s branded leak page names Southeastern Oklahoma State University and se.edu and claims a 710 GB collection containing 171,499 files and 19,366 folders. The group alleges the collection includes student names, contact information, Social Security numbers, grades, enrollment and financial-aid data, disciplinary and medical information, Forms 1095-C, more than 490 documents, records tied to more than 90,000 students, and employee identity, injury, Medicare and child-custody or consent information. The page shows document thumbnails and a “GET” button. A separate screenshot shows a directory listing with 11 folders and their stated sizes. The images document what Interlock claimed to possess and presented as available through its site. They do not establish that the files are authentic, originated from the university or were downloadable in full. The university has not confirmed data theft, ransomware or Interlock’s involvement.

Interlock reportedly listed AngMar Companies. Teiss associates the claim with AngMar Management Services, but the exact entity and incident linkage is unverified. This claim does not establish actor responsibility, ransomware deployment, data theft or the alleged 710 GB volume.

A confidential source working inside AnMed provided a photograph of a ransom demand displayed on a hospital screen, including a victim-specific Tor address for a negotiation chat server and a unique access code used to establish a negotiation account. The Tor address resolved to infrastructure associated with Interlock. The ransom note claims encryption and data theft, imposes a 72-hour deadline and threatens publication, but the visible text does not identify either AnMed or Interlock by name. The victim-specific negotiation infrastructure provides substantive evidence supporting medium-confidence attribution to Interlock.

That assessment is complicated by later, materially conflicting evidence. The Gentlemen subsequently listed AnMed on its leak site, and Gentlemen-branded messages were posted through AnMed’s compromised social-media accounts. AnMed’s Aug. 27 notice says a virus locked access to network files and files on certain systems were copied without permission, but it does not identify a threat actor or establish the encryption implementation.

The Tor address and negotiation code are withheld to protect private victim communications.

Interlock claimed the District of Columbia Housing Authority on its leak site. Daily Security Review reported the listing, and BreachSense reported a claimed 1,660 GB volume. DCHA confirmed only that a limited subset of data including sensitive information was compromised; it did not confirm Interlock, the claimed volume, data theft, ransomware encryption or a demand.

External threat-intelligence reporting says Interlock claimed responsibility on May 11, 2026 and threatened release of allegedly stolen data; KDL has not publicly confirmed the attribution in reviewed sources.

Interlock publicly claimed the April 2026 attack and posted purported samples, but Winona County did not name the group and the reporting outlet could not independently verify attribution or the claimed file volume.

Interlock listed Community College of Beaver County and claimed it stole 780 GB and published records. CCBC later confirmed unauthorized access and that an unauthorized party obtained information, but it did not attribute the incident to Interlock or corroborate the group’s claimed data volume or publication. The claim supports low-confidence attribution, not proof of actor responsibility or the provenance and completeness of material Interlock presented.

Interlock listing carried an incorrect Pennsylvania affiliate label, but reviewed materials appeared to identify Goodwill Industries of Greater Grand Rapids. Treat as an attribution claim, not confirmed responsibility.

Interlock listed Wagon Mound Public Schools and claimed it obtained about 80 GB of staff and student information. The district confirmed malware and operational disruption but has not corroborated Interlock, ransomware or data theft.

Interlock listed Clarksville ISD as a purported victim and alleged theft of personal and financial information, as recorded by ransomware.live and our Dec. 19 report. The district confirmed a serious network outage but has not confirmed Interlock’s claim, ransomware, data theft or a causal link to that outage.

Interlock listed Fargo Park District as a purported victim on its leak site, as recorded by ransomware.live and our Dec. 5 report. The district has confirmed an October ransomware incident but has not attributed it to Interlock or confirmed the listing’s allegations.

Interlock claimed the department and alleged theft of 208 GB including camera material. Police confirmation of attribution or theft was not found.

Interlock listed the district and claimed 354 GB access. Superintendent later confirmed the group had accessed sensitive files after a Fortinet investigation, but no ransom demand was received and the volume was not validated.

Comparitech’s explicitly dated original August 13, 2025 report describes Interlock listing Box Elder County and publishing alleged samples, claiming 4.5 TB and about 2.1 million files. The county later confirmed ransomware, theft and publication, but did not identify Interlock or verify these volumes. Attribution remains low confidence. MCP name/domain searches returned no matching lead; no discovery timestamp or unvisited leak URL is invented.

Interlock listed City of St Paul/stpaul.gov; ransomware.live discovered the claim Aug.11,2025. The city independently confirms approximately43GB of data stolen/exposed from a Parks and Recreation drive and no ransom payment. Its reviewed official report does not name Interlock, so responsibility remains a qualified actor claim.

Tracker records an Interlock claim naming the district and matching lexrich5.org. Discovery date does not establish intrusion onset or original claim publication. Claimed data volume is unverified; the district independently confirms theft, historical record release and attribution.

Interlock listed the district’s exact name and domain. Independent reporting described its allegation of 2.64 TB of stolen data, 2 million files and 360,000 directories. The district confirmed unauthorized network activity and potentially affected personal files but has not confirmed Interlock’s responsibility, the claimed volume or encryption scope. June 13 is the lead discovery date, not original publication or attack time.

Kettering Health says its investigation gives it reason to believe Interlock carried out the May 2025 incident. The exact-name and domain claim searches returned the same Interlock listing, discovered June 4, 2025. The original listing publication time is unverified; discovery is not attack onset. Preserve the victim’s qualified assessment. This record does not independently verify the actor’s file counts, encryption scope or ransom terms.

An Interlock-branded listing identifies Kalamazoo Public School District and its domain. The tracker discovered it May 23, 2025, and TechNadu reported the claim May 24. Confidence in responsibility is low: the district confirmed unauthorized access and possible file copying but did not identify Interlock, encryption or a ransom demand. The original posting and attack dates are not established. The separate PowerSchool breach is not attributed to this claim.

Stable Interlock-attributed tracker record identifies DaVita and its exact davita.com domain. The April 25 timestamp records tracker discovery, not attack onset or original publication. DaVita’s own incident update says an actor posted claimed stolen data April 24 and that the company obtained the posted set around June 18 and confirmed laboratory information was involved. This supports a data publication finding without independently proving Interlock responsibility. External reporting attributes the claim to Interlock and describes roughly 1.5 TB; the volume is an allegation, not a confirmed measurement. The company has not publicly confirmed the gang, ransom amount or payment outcome. Original leak-post URL and exact claim publication time remain unknown. No separate claim against DaVita Labs was found in canonical-name and domain searches.

DataBreaches reported an Interlock listing and interviewed the group on March31,2025. Attackers alleged encryption at AMTEC,Tech Ord and Presto and theft of4.2TB. Their supplied alleged company message described restored operations/refusal to pay; it is not authenticated company confirmation. Exact original listing date and direct Tor post URL not verified. Repair existing claim, not a second incident or duplicate attribution; incident attribution confidence low. Ransomware.live domain lookup independently matched National Defense Corp,Interlock,US,nationaldefensecorp.com,first observation2025-03-29T21:57:27.927013Z. That is monitor discovery,not original posting/onset;direct monitorpage blocked by browser safety policy. Original reporter interview remains incident evidence at linked DataBreaches source.

Interlock claimed responsibility for the February2025 Aztec network incident and alleged theft of1.3TB of financial/tax and employee/student data. Original Comparitech March21 reporting describes a leak-site listing and alleged document images, expressly unverified by district. MCP ransomware-search canonical-name/domain queries identify this same exact claim with March22 tracker observation; actual original posting timestamp unverified. No verified demand/payment/entryvector/encryption/theft volume. Direct tracker browser inaccessible under safety restriction; no bypass. Preserve existing Interlock relationship, repair this claim rather than duplicate.

Interlock claimed responsibility and alleged theft of 4,140 GB, including an SQL database with employee, police and emergency-service information, according to Comparitech’s Dec. 20, 2024, report. Officials had not verified the group’s attribution or alleged contents. The city independently confirmed unauthorized acquisition of personal information but did not identify Interlock or confirm encryption. The tracker observed the listing on Dec. 20 UTC; this is not a verified original actor-post publication time. No ransom amount or payment is established.

Ransomware.live indexes an Interlock claim under the listed name Winnebago Public School Foundation and the district’s verified winnebagopublicschools.org domain. The tracker observed it Nov. 7, 2024, at 11:14:06.006864 UTC; this is not a verified attack date or original actor-post time. Original Comparitech reporting that day associates the claim with the October district cyberattack and reports an allegation of 223 GB of stolen data and alleged sample images. The district independently acknowledged a cyberattack and operational disruption, but the reviewed evidence does not independently establish Interlock responsibility, encryption, the claimed data volume, a ransom demand/payment or confirmed publication of district information. Attribution and ransomware confidence remain low. The district’s official website describes its foundation as a supporting organization with a separate board; the tracker label is preserved as an allegation, not adopted as a district legal alias or proof of a separate foundation victim.

The district’s official FAQ attributes the June 3 ransomware incident to Interlock. This is affected-organization attribution rather than an independently reconstructed forensic finding. The FAQ’s original publication date is not displayed.