Passaic County

Passaic County, New Jersey, was hit by a ransomware attack that disabled the county government's phones, computers, and internet service, and data from county systems appears to have been stolen. County records show suspicious activity was detected around March 4, 2026, and officials later confirmed that attackers accessed and obtained data and demanded a ransom, which the county did not pay. A cybercriminal group calling itself Medusa claimed responsibility and posted images of what it said were stolen county documents, though the county has not confirmed that attribution. The investigation team has indexed more than 606,000 records tied to the incident and lists an estimated attack date of April 23, 2026, alongside county records pointing to detection in early March.

March 4, 2026: Passaic County posted a statement saying a malware attack was affecting its IT systems and phone lines and that it was working with federal and state officials.

March 18, 2026: The county told Comparitech that most operations had been restored and that investigators were working to determine the nature and scope of unauthorized access to data.

July 14, 2026: County commissioners approved nearly $147,000 in additional funding for cybersecurity and recovery work, bringing authorized response costs to nearly $395,000.

What Information Was Compromised?

Our analysis found the following data types in this breach: 606,269 records containing names, 434,006 birthdays, 285,851 phone numbers, 75,017 email addresses, 52,846 street addresses, 36,697 Social Security numbers, 2,207 vehicle license plates, 1,246 vehicle identification numbers, and 74 driver's license numbers.

County officials have not published their own list of what was taken. As of September 25, 2026, a spokesperson said a review of the data was still underway to determine which records and information were involved, and the county had not said how many people may be affected.

Not every individual is affected by every type of data listed here.

What Are the Potential Risks for Affected Individuals?

Social Security numbers and driver's license numbers in the wrong hands can be used to open accounts, file fraudulent tax returns, or apply for credit in someone else's name. Those are the most consequential items in this dataset. Names paired with phone numbers and email addresses are useful for targeted phishing, in which a caller or sender poses as a county office, insurer, or bank and already knows personal details to sound convincing. Addresses, birthdays, and vehicle details can support identity fraud and physically targeted scams. Because the affected organization is a county government, residents should also expect scammers to reference property records, permits, court matters, or benefits as a pretext for contact.

What Is Passaic County Doing in Response?

According to reporting by NorthJersey.com, the county hired the cybersecurity firm MOXFIVE to restore systems and conduct a forensic analysis under the direction of outside counsel, and its contract has grown to more than $304,000. The county also authorized $75,000 for the law firm BakerHostetler and $15,000 for CyberSteward, which handled communications with the attackers. Officials said neither the county, its insurer, nor anyone working on its behalf paid a ransom. The county carries cyber insurance through AIG with a $150,000 deductible and is pursuing a claim. The network has been restored and the forensic investigation is complete, but the review of what data was taken continues, and the county has not confirmed how much data was stolen or whether it was posted online.

What Should You Do If You Were Affected?

If you have interacted with Passaic County government, take these steps now:

Check your credit reports at annualcreditreport.com and watch for accounts you do not recognize.

Consider placing a fraud alert or security freeze with the three credit bureaus, especially if you had a Social Security number in county records.

Watch for phishing emails, texts, and calls that reference the county, and verify requests through official phone numbers rather than ones provided in a message.

Monitor your bank, insurance, and tax records for unusual activity.

File reports with the FTC at identitytheft.gov if you see signs of misuse.