CodeRED Emergency Alert Breach: Thousands of Towns, One Vendor
If your town's emergency alerts went quiet in November 2025, this is why. The alert vendor was hit by ransomware and subscriber contact details were taken. There is no lawsuit and no settlement — but there is one thing worth doing today, and it takes two minutes.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened
CodeRED is the emergency notification system that many US cities and counties use to send residents warnings by phone, text and email. Its operator — Crisis24, formerly OnSolve, part of GardaWorld — was attacked by the ransomware group INC Ransom. Reporting places the initial access on November 1, 2025 and the encryption of systems on November 10, 2025, which knocked alert systems offline across the country. Because the compromise sat with the vendor, individual towns were affected without anything going wrong on their own systems.
Case Details
No class action over this incident has been filed that we could find, in any court, as of August 2026. Be careful not to confuse this with an unrelated 2023 breach at GardaWorld Cash, a different business line, which did settle. That older case has nothing to do with the CodeRED alert system.
Where Things Stand Today
Who Was Affected and What Was Taken
Anyone who signed up for CodeRED alerts through a participating city or county. The data involved is subscriber profile information: name, address, email address, phone number and, according to the attackers, account passwords. Crucially, Social Security numbers were not part of it — CodeRED signup never collected them — and there are no reports of health or banking data. That is why the risk profile here is different from a medical or financial breach: the realistic danger is targeted phishing and password reuse, not someone opening credit lines in your name. No official nationwide total has been published. The figure of more than a terabyte of stolen data comes from the attackers' own leak site and should be treated as their claim, not as a verified fact.
Is There Any Money in This?
Timeline
- 1
November 1, 2025 — initial access
Reporting places the ransomware group's first access to the CodeRED environment on this date, more than a week before anything became visible to the public.
- 2
November 10, 2025 — systems encrypted
Systems are encrypted and CodeRED alert services go offline across the United States.
- 3
November 11, 2025 — counties learn of the outage
Counties are informed that the alert system has been down since the previous day. Weld County, Colorado — which covers communities including Dacono — was among those affected.
- 4
Late November 2025 — the extent becomes public
Security reporting identifies the attackers as INC Ransom and describes stolen subscriber data. The operator confirms the attack. Several sheriff's offices announce contract reviews, and at least one cancels outright.
- 5
Local notices, no national notice
Notification was handled community by community rather than through one national letter. Published municipal notices tell residents to change reused passwords and state that there is no evidence of identity theft or fraud — which is also why no monitoring was offered.
- 6
2026 — service continues under a new platform
Counties that stayed with the service moved to the successor platform operated by Crisis24. No litigation over the 2025 incident has surfaced.
The Real Risk Here Is Phishing
This breach handed criminals verified names, phone numbers and email addresses tied to real addresses. After a comparable alert-system breach elsewhere, stolen contact details were used to send fake delivery and transaction texts. That is the pattern to expect.
Texts about a package, a toll or a suspicious transaction
Do not tap links in unexpected texts, even when they use your correct name. Open the company's app or type the address yourself.
Anyone claiming there is a CodeRED settlement to claim
No case has been filed. A site collecting your details for a CodeRED payout is collecting them for something else.
Calls that already know your address
Knowing your name and address proves nothing now — that combination is exactly what was taken. Treat it as no evidence of legitimacy at all.
Frequently Asked Questions
Is there a CodeRED settlement I can claim?
No. As of August 2026 there is no class action and no settlement over this incident, so there is no claim form, no administrator and no deadline.
Was my Social Security number exposed?
No. CodeRED signup does not collect Social Security numbers. The exposed data is contact information — name, address, email, phone — and account passwords.
What should I actually do?
One thing, and it matters: if you used your CodeRED password anywhere else, change it everywhere you reused it. Beyond that, expect phishing that uses your real name and address, and treat unexpected texts and calls accordingly.
Why was I not offered credit monitoring?
Because no Social Security numbers or financial data were involved, the municipal notices stated there was no evidence of identity theft or fraud. Monitoring is normally offered when SSNs are exposed, which is not the case here.
My town never sent me anything. Was it affected?
Possibly. Notification was handled locally, not nationally, and coverage varied a lot from one community to the next. Because the alert system is often run by the county rather than the city, the notice may have come from your county — or not at all. Check your county emergency management page.
Who is actually responsible — my city or the vendor?
The compromise was at the vendor, Crisis24 (formerly OnSolve), not on municipal systems. Cities and counties were customers whose subscriber lists sat with that vendor.
Should I stop using emergency alerts?
No. Emergency notifications are worth keeping for evacuation and severe-weather warnings. Use a password you do not use anywhere else, and give only the contact details you need to receive alerts.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.