Wayne County Michigan Government Ransomware Breach (2024): 206K Resident Records Including SSN & Government Services Disrupted

About Wayne County, Michigan

Wayne County is the most populous county in Michigan (home to Detroit), serving roughly 1.75 million residents. Its government administers property tax, courts and criminal justice, vital records, health, and other public services, maintaining resident, employee, vendor, tax, property, court, and criminal-justice records across county systems.

Why They Hold Your Data

County governments aggregate identity, address, tax, property, court, licensing, and public-service records tied to residents, employees, vendors, and administrative operations.

Recent Developments

An October 3, 2024 ransomware attack disabled county websites and disrupted property-tax payments, case management, estate sales, inmate processing, and court scheduling. In February 2025 the Interlock ransomware group claimed responsibility, and the stolen data was leaked around March 1, 2025. The county worked to restore services and investigate.

Data Points Exposed

Breach Impact

The breach exposed a large volume of resident data, including Social Security numbers, bank account details, and confidential criminal-investigation and court records, creating identity-theft, financial-fraud, and privacy harms and raising unusual risks around exposure of criminal-justice information. The attack also disrupted essential public services for one of the nation's largest counties, eroding public trust.

Exploitation & Downstream Threats

• Identity theft and synthetic identity construction using SSN | • Financial fraud using exposed bank account details | • Exposure and misuse of confidential criminal-investigation and court records | • Government-services and benefits-fraud phishing | • SIM swap and vishing attacks where phone numbers are present

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
3. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).