RANSOMWARE STRIKES MICHIGAN CITY, INDIANA — NEW GROUP “OBSCURA” CLAIMS RESPONSIBILITY FOR 450GB DATA THEFT

MICHIGAN CITY, INDIANA — October 2025
Officials in Michigan City have confirmed that the cyber incident which crippled municipal operations in late September was a ransomware attack, marking yet another strike against U.S. city infrastructure as ransomware groups continue expanding their focus beyond major metropolitan targets.

The attack, which occurred on September 23, initially forced the city to take multiple systems offline and was described at the time as a “network disruption.” But after a three-week forensic review, city leaders acknowledged what many had suspected — a ransomware intrusion that encrypted critical systems and compromised an undisclosed amount of city data.

In a statement released Saturday, officials said the event “affected a portion of the City’s data and impacted municipal employees’ online and telephone access.”

---

Systems Down, Phones Silent

Mayor Angie Nelson Deuitch informed the Michigan City Common Council that the city’s priority remains restoring systems safely while ensuring essential services remain operational.

“A forensic investigation remains underway,” the city wrote, adding that an External Incident Response Team — composed of IT specialists from both municipal departments and outside agencies — is working to determine “the full scope and impact” of the breach.

Local and federal law enforcement are involved, restricting how much the city can disclose publicly while the case remains active.

Michigan City, home to roughly 30,000 residents, sits along Lake Michigan’s southern shore — a key regional hub for tourism, logistics, and small-scale industry. Officials have not indicated whether public safety systems, emergency services, or financial data were directly impacted.

---

A New Ransomware Player Enters the Field

On Monday, the Obscura ransomware gang claimed responsibility for the breach, asserting that it had stolen approximately 450 gigabytes of data from Michigan City’s networks.
The group alleged that the city missed its ransom deadline and declared that it had “released all stolen data” to its leak site on the dark web.

If confirmed, the disclosure could expose sensitive internal communications, resident information, or infrastructure documentation.
Cyber analysts say Obscura only surfaced in September 2025, but has already listed more than 15 victims across government, healthcare, and logistics sectors — signaling a rapid operational ramp-up for a group that appears to blend tactics from several older ransomware families, including LockBit, Royal, and Black Basta.

Early indicators suggest Obscura is using multi-layered extortion, where data theft, encryption, and public shaming are combined to pressure victims even after recovery. The group’s infrastructure is believed to be hosted across Russia and Eastern Europe, utilizing bulletproof hosting providers and cryptocurrency-based laundering services.

---

A Broader Pattern in Indiana

The Michigan City attack follows a troubling pattern across Indiana’s local governments.
Just last year, another municipality in the state declared a local disaster emergency after ransomware crippled systems used by multiple government offices.
Experts say the escalation in attacks targeting smaller cities reflects a strategic shift — hitting municipalities that lack the layered cybersecurity funding and rapid recovery capabilities of larger metro areas.

According to the FBI’s Internet Crime Complaint Center (IC3), municipal ransomware attacks have surged nearly 40% year-over-year, with many groups viewing local governments as “soft targets” due to legacy systems, limited monitoring, and slower response times.

---

The Recovery and the Silence

City officials have not commented on whether a ransom demand was received or paid, nor whether the city’s data backups were affected.
Michigan City’s IT teams continue working with external forensic experts to restore full functionality. Mayor Deuitch said updates will be shared “as soon as possible,” acknowledging that operational transparency must balance with investigative security.

While the breach remains under investigation, cybersecurity analysts caution that Obscura’s appearance and tactics suggest a potential evolution in ransomware-as-a-service models, where emerging crews recycle tools, infrastructure, and code fragments from prior dark web alliances.

In the broader ransomware landscape, the name may be new — but the playbook is familiar:
Encrypt, extort, expose, evolve.

And for small American cities, that cycle has become the new normal.

---

---

---

---

---

---

---