The Pennsylvania Attorney General’s Office Updates Ransomware Attack Incident

On 21 September 2025, INC Ransom added the Pennsylvania Attorney General’s Office to its darkweb leak site, though it remains unclear whether data has actually been leaked. On 17 September, the Office of Attorney General published an update to a ransomware incident it had initially disclosed on 11 August, stating that the attack encrypted certain files to compel a payment and that no payment had been made.

According to The Office of Attorney General, an active investigation remains ongoing in coordination with partner agencies, with a principal focus on determining what information was involved. The update also noted that a few individuals had been notified that their information may have been involved, with further notifications to follow as appropriate. The office emphasised its commitment to protecting information and upholding public trust while safeguarding operational integrity.