Box Elder County, Utah ransomware attack: 81,664 people, no ransom paid, data posted online

Was Box Elder County hit by ransomware?

Yes, in the county's own words: its notice to New Hampshire describes "a ransomware incident" that involved unauthorized access to and acquisition of names and Social Security numbers. teiss reports that the Interlock ransomware group named the county on its leak site and claimed to have stolen 4.5 TB of data, more than 2 million files. Those figures are the group's claim; the county has not confirmed them.

The attack locked several county systems. In its August update the county said the breach had temporarily locked multiple county government systems, and that on the morning of August 14, 2025 it was told the attackers had obtained some county data. It worked with the FBI, the Utah State Bureau of Investigation and the Utah State Cyber Crimes Task Force.

Was the Box Elder County election affected?

No, according to the county clerk's office, which addressed the primary election directly. The county says the tabulation equipment is never connected to the internet or the county network, that no ballots had been tabulated when the incident happened, and that computers used to verify signatures were scanned for malware. It said the integrity of the primary election was not breached.

What happened, and when?

Date	What happened	Source
May 6, 2025	Start of intermittent access; Indiana's breach date	County letter; Indiana record
August 3, 2025	Ransomware detected; access ends	County letter
August 14, 2025	County told the attackers had obtained county data	County updates page
November 17, 2025	County finishes reviewing the data the attackers posted	County letter
December 17, 2025	Letters mailed; notice to New Hampshire; Indiana's notice date	County letter; Indiana record

From the ransomware alarm to the letters took 136 days. The notice-delay guide puts that in context; the median for the local governments in Indiana's report is about six months.

What information was involved in the Box Elder County breach?

The data the attackers took included public records as well as personal information. The county's notice to New Hampshire names two items for the residents it covers there: names and Social Security numbers. The letter to residents fills in each person's own items, so the letter is the place to check. Because the county reviewed the data that was actually posted online, a letter from Box Elder County means your information was in that posted set.

How many people were affected by the Box Elder County breach?

81,664 people, the total Indiana's attorney general records; teiss reports the same figure from the county's filing with Maine. The county's New Hampshire notice covers two residents there.

Record	What it counts	Number
Indiana attorney general	People affected in total	81,664
Indiana attorney general	Indiana residents	15
New Hampshire letter	New Hampshire residents	2

Among the 29 city, town and county governments in Indiana's 2026 report, Box Elder County's notice is the fifth largest, after the City of Suffolk, Virginia, the City of Middletown, Winona County and the City of McMinnville; the guide to local government breach notices has the full table. Winona County, Minnesota is the other county in this log hit by ransomware.

What is Box Elder County offering people who got a letter?

A complimentary membership with IDX for credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy and identity theft recovery services, for the term printed on each letter. The letter gives a dedicated assistance line, 1-833-809-5038. The county's general line for questions about services is (435) 734-3300.

The county also says it has deployed new security tools, monitors its network with endpoint detection, reset every password across the organization and tightened external access to its network.

Was my information in the Box Elder County data breach?

If you got a letter from Box Elder County dated December 17, 2025, your information was in the data the attackers posted. If you did not and you have dealt with the county, the assistance line on the letter is the place to ask. Because the data was published, a credit freeze with the three bureaus is a free step worth taking now; the guide to credit monitoring offers explains how it differs from monitoring.

What the documents leave open

• How the attackers first got into the county's network in May 2025.
• How much of the posted data was public records and how much personal information.
• Whether the attackers named a ransom amount.