CodeRED Emergency Alerts Disrupted Across US After Ransomware Breach

Multiple US communities scramble for alternatives after a cyberattack cripples a major emergency system.

Widespread outages hit local emergency notifications

A ransomware attack on Crisis24, the vendor behind the CodeRED emergency alert system, has left towns and cities across the United States without a core public-warning tool. CodeRED is widely used to push urgent notifications for severe weather, public safety incidents, missing persons and other critical situations.

In the aftermath of the intrusion, many municipalities issued nearly identical advisories confirming the system was offline and advising residents to expect emergency information through temporary channels.

The disruption proved severe enough for some jurisdictions to sever ties with Crisis24 entirely. Douglas County, Colorado, announced that it had terminated its CodeRED contract and is seeking alternative vendors. Others, however, indicated a willingness to stay with the company as it prepares to deploy a rebuilt version of the platform.

Crisis24 promises a clean slate platform

According to notices sent to customers, Crisis24 is rushing through the rollout of a revamped CodeRED system hosted in a separate environment untouched by the threat actors. The company said the new platform underwent a full security audit, penetration testing and infrastructure hardening before being proposed as a replacement.

City officials in University Park, Texas, doubled down on the company’s reassuring stance, stating that they were in the process of migrating their alert capabilities, emphasizing their commitment to resident data protection. In the meantime, affected communities fell back on social media posts, reverse 911 phone calls and even door-to-door notifications when necessary.

Stolen data and stronger password warnings

Although CodeRED itself was taken offline, the perpetrators reportedly accessed a broad range of customer data, including:

• Full names
• Addresses
• Phone numbers
• Email addresses
• Account passwords

Several municipalities urged residents who created CodeRED accounts to change any reused passwords immediately to prevent credential-stuffing attacks.

Crisis24’s own FAQ section confirmed that only CodeRED was affected by the security incident, adding that it has no evidence of broader compromise. However, it also warned that stolen data may surface online despite the lack of early signs of leakage.

INC ransomware group claims responsibility

The INC ransomware gang has taken credit for the intrusion and published samples of stolen data on its leak site. The group also posted what appear to be fragments of negotiation logs, showing an initial ransom demand of $950,000, which was later reduced to $450,000. Crisis24 allegedly countered with offers of $100,000 and later $150,000, both of which were rejected.

The threat actors claim they gained access on Nov. 1 and deployed encryption on Nov. 10. With negotiations stalled, they now say they will sell the stolen information. Crisis24 maintains it is supporting all affected localities to keep emergency communications online during the transition.

Strengthening personal security after data breach

In the wake of breaches where names, emails and contact details fall into criminal hands, residents and organizations may also want to strengthen their visibility over how their personal data circulates online.

Bitdefender Digital Identity Protection can help monitor for leaked information across data dumps, dark-web marketplaces and other high-risk sources, alerting you the moment your identity appears in a breach.