MalwareIdentity (basic)Government IDFinancial accountMediumContained

City of Aurora

bd_b63450b59a36995a · schema v1 · pii pii-v2

Severity

Medium

Discovered

Feb 3, 2025

Filed

Jan 12, 2026

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for City of Aurora →

The City of Aurora, Nebraska, notified residents of a ransomware attack on its IT service provider's network discovered on February 3, 2025. The incident potentially exposed names, DOBs, driver's license/ID numbers, SSNs, and financial account numbers. The City retained forensic experts, enhanced security systems, and provided 12 months of free credit monitoring and fraud assistance via Cyberscout (TransUnion). No evidence of actual misuse was found at the time of notification.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d

Incident timeline

Feb 3, 2025

Discovered

Jan 12, 2026

Filed

This filing is one of 2 about the same incident.View merged incident

A leak claim by medusa about this victim predates this filing by 319 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemedusabd_0c03ac759ff6ace02025-02-26 · +319dCandidate

Name: City of Aurora, Nebraska
norm: city of aurora nebraska

Name: City of Aurora
norm: city of aurora
Domain: auroragov.org

Discovered: Feb 3, 2025
Materiality determined: —
Notification sent: Jan 12, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial

During the incident: Launched an internal investigation
Retained several external, nationally recognized computer forensic experts
Made immediate enhancements to its systems, security and practices
Engaged appropriate experts to assist in conducting a full review of its security practices and systems
Providing you with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing you with proactive fraud assistance
Changes made: Made immediate enhancements to its systems, security and practices
Engaged appropriate experts to assist in conducting a full review of its security practices and systems to ensure that enhanced security protocols are in place going forward
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/e4e3e93f-0e4f-4867-95e6-603abd019384.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 12, 2026
Raw hash: db00c7427ef38331104601da2e4d9ea90531bc051ea81a19b603b8f14e3fabd8

Linked disclosures

Ransomware claims (1)

Reporting entityCity of Aurora, Nebraska

Victim entityCity of Aurora

Incidentdiscovered Feb 3, 2025

Stated responseLaunched an internal investigation

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancenebraska.gov