Risk management firm Crisis24 has revealed that its OnSolve CodeRED emergency alert platform was compromised in a cyberattack that disrupted notification systems for numerous U.S. state and local agencies, including police and fire departments.
CodeRED is widely used to issue public alerts during critical incidents. Following the intrusion, Crisis24 was forced to take its legacy CodeRED infrastructure offline, which led to significant service interruptions for organizations that depend on the system for emergency messages, weather notifications, and other critical alerts.
According to statements and an FAQ shared with affected customers, Crisis24’s investigation found that the incident was isolated to the CodeRED environment, with no impact on the company’s other systems. However, the company confirmed that attackers exfiltrated customer data, including names, home addresses, email IDs, phone numbers, and passwords associated with CodeRED user profiles. Crisis24 says it has not seen evidence that this stolen information has been released publicly.
The City of University Park, Texas, echoed this in a public notice, stating:
"CodeRED has informed us that while there are indications that data was taken from the system, at this time, there is no evidence that this information has been posted online."
Because the attack severely damaged the platform, Crisis24 is now rebuilding CodeRED by restoring backups into a newly launched environment. The available backup was dated March 31, 2025, meaning some user accounts and data may be missing as the system comes back online.
Agencies across the country—counties, cities, and public safety departments—have been informing residents of service disruptions and working to restore their emergency alert capabilities.
Although Crisis24 attributed the attack to an “organized cybercriminal group,” BleepingComputer has confirmed that the INC Ransomware gang has taken responsibility. The group added an entry for OnSolve on its Tor-based leak site and shared screenshots displaying what appear to be customer emails and passwords in clear text.
INC Ransom claims it infiltrated OnSolve’s systems on November 1, 2025, followed by file encryption on November 10. After not receiving a ransom payment, the group says it is now attempting to sell the stolen data.
Because the leaked passwords are shown in readable text, customers are urged to reset any CodeRED passwords used on other platforms.
INC Ransom is a ransomware-as-a-service (RaaS) operation that emerged in July 2023 and has since attacked organizations around the world. Its victims span multiple industries, including education, healthcare, government agencies, Yamaha Motor Philippines, Scotland’s NHS, retail giant Ahold Delhaize, and Xerox Business Solutions in the U.S.