The city of Princeton, Texas, has confirmed that confidential records and personally identifiable information were taken from its computer systems during a cyberattack first disclosed in September. The INC Ransom gang, also tracked as Incransom, has listed the city on its leak site and claims it holds a backup of the city's internal file server. According to QPulse's write-up of the leak listing, the group says the data covers more than 14,000 citizen records, more than 1,000 municipal court case files and forensic extractions of the mayor's iPhone and iPad. The city has not said what types of records were taken or how many people are affected. It has not commented on the gang's claims. No regulator filing or official breach notification count has been published.
What Happened
Princeton's public statements about the incident changed between September and October.
- Sept. 18: The city said it was investigating a "cybersecurity incident involving potential unauthorized access to certain city systems and data," according to the Princeton Herald.
- Sept. 21: The city council added an emergency item on the possible breach to a special meeting, but said there was nothing further to report.
- Sept. 22: The city called it an "alleged cybersecurity incident." It said two independent reviews by cybersecurity experts had found no evidence of unauthorized access, a confirmed breach or data exfiltration. It hired a third firm for a full forensic review "out of an abundance of caution."
- Sept. 28: A resident who described himself as a technology specialist told councilmembers he believed unauthorized purchases had been made with a credit card he kept on file with his city account. He also said data purportedly from the hack had been posted online, according to the Princeton Herald. The city has not linked his card activity to the incident.
- Oct. 5: The city reversed its earlier position. It said the continuing forensic investigation found that confidential information and PII had been exfiltrated. Mayor Eugene Escobar Jr. said "all impacted parties will be contacted directly with appropriate guidance." The city says affected people will be notified as the law requires and offered identity protection and credit monitoring. Essential services kept running normally.
- Oct. 13: The council's special meeting agenda listed two closed sessions with the city attorney on the attack, as Princeton Weekly reported. Listed topics included legal liability, notification duties, insurance, potential litigation and "threat actor communications." The agenda describes "the exfiltration of confidential, sensitive, and protected information." The city has not said what those communications with the threat actor involved.
Dates differ between trackers. Breach-claim tracker Breachsense listed Princeton as an INC Ransom victim with a date of Sept. 17, according to Princeton Weekly. Yazoul and Breach House both record the leak-site listing as Oct. 11. QPulse says the gang set a 10-day deadline to pay before it publishes the data. Breach House showed the leak status as "pending" when it last checked on Nov. 12, and recorded the city as "not disclosed." That is wrong: the city had publicly confirmed the data theft on Oct. 5.
Location details also conflict. The leak listing, as Yazoul quotes it, describes the victim as a fast-growing Collin County city in the Dallas-Fort Worth area with 35,000 to 50,000 residents. Breach House's automated summary places the city in Angelina County in East Texas. The council meetings, the mayor and local press coverage all match the Collin County city.
What Was Taken
The city has confirmed only that "confidential information" and "personally identifiable information" were taken. Every detail below comes from the attackers' claims as reported by threat-intelligence trackers. None of it has been independently verified.
How much data: - Yazoul says the leak listing claims about 2 GB of data. - QPulse describes a much larger set built around a "complete backup" of the internal file server. Yazoul's account of the listing says that backup covers more than 20 city departments. - QPulse separately mentions 1.9 GB of email archives. That figure is close to the 2 GB total. - It is not clear whether the 2 GB figure covers the whole set or only part of it.
What QPulse says the gang claims to hold: - Citizen records: more than 14,000, with names, addresses, utility account numbers and partial Social Security numbers. - The mayor's devices: forensic extractions of the mayor's iPhone and iPad, totalling nearly 300,000 items. These include private SMS and iMessage history, call logs and personal documents. - Municipal court files: more than 1,000 case files, with defendant information, insurance card scans and video evidence. - Email archives: 1.9 GB covering active legal matters, internal investigations and personnel negotiations. - Live credentials: logins for HR and payroll, library management and notary portals. QPulse says many follow predictable password patterns. - Infrastructure documents: water and wastewater master plans, engineering specifications and security camera layouts for city facilities.
Why It Matters
This is not only a privacy breach. If the claims are accurate, the leak would expose working logins, camera placement and water system plans along with residents' personal data. Anyone who downloads the leak could use the credentials to get back into city systems. They could also use the camera and water documents to plan physical intrusion or tampering. Even after the attackers are removed from the network, those risks remain until every password is changed and the physical security gaps are reviewed.
The device extractions widen the exposure. Forensic images of an elected official's phone and tablet hold third-party messages and contacts that never sat on city servers. Those people could become targets for phishing and extortion.
The early "no evidence" finding was wrong. Two outside reviews found no sign of data theft. Then the city confirmed it two weeks later. That pattern is common: exfiltration often turns up only in deeper forensic work, after the attackers' own listing has already appeared. Saying "no evidence of exfiltration" early carries reputational and legal risk once the gang starts publishing.
INC is active against U.S. organizations. In the same few weeks, trackers recorded several other INC claims: - Onmion LLC: QPulse reports the gang took 179 GB from this managed IT provider in Washington state and reached three of its clients. - Wavecrest HFA: DeXpose logged a claim of about 24 GB, in roughly 12,000 files, on Oct. 7.
Yazoul describes INC as a double-extortion operation active since 2023, with a focus on healthcare, government and education.
The Attack Technique
How the attackers got in is unknown. The city has not said how its network was breached. Neither the council agenda nor the city's updates name the entry point, though the agenda does list "system vulnerabilities" as a topic for closed session. No indicators of compromise have been published.
Little is documented about INC's tools. Yazoul notes that open-source research on INC's tooling is thin. Broader reporting links the group to standard ransomware builders and common ways of getting into networks. The Onmion case shows one route the group has used: QPulse reports the attackers reached client networks through the provider's shared FTP servers, backup systems and SolarWinds N-Central remote management platform. Nothing so far links Princeton's breach to any IT provider. The Onmion example shows the kind of access INC uses, not what happened in Princeton.
Several claimed details point to deep, lasting access rather than a quick smash-and-grab: - a full file-server backup - forensic-grade device images - 1.9 GB of email
Mobile device extractions usually come from backups, device-management tools or forensic images stored on the network. That suggests the attackers reached storage where IT or legal staff kept sensitive collections.
What Organizations Should Do
- Treat a leak-site listing as confirmed theft until proven otherwise. When a gang names you, start credential rotation, legal preparation and resident communications right away. Do not wait for forensic reviews that may first come back negative.
- Rotate every credential that could be in stolen files. Cover HR, payroll, library, notary and vendor portals. Ban predictable password patterns and require phishing-resistant multi-factor authentication on all internet-facing municipal systems.
- Find and lock down sensitive collections. Locate stored forensic images, device backups, legal-hold exports and email archives. Encrypt them, restrict access to named staff and keep them off general file shares.
- Treat infrastructure plans and camera layouts as security-sensitive. Store water and wastewater plans and camera maps apart from general file servers. If they may have leaked, review physical security and operational technology access.
- Watch for bulk data leaving the network. Alert on large outbound transfers, archive creation on file servers and unusual backup access. Keep logs long enough to reconstruct exfiltration weeks after the fact.
- Audit remote management and IT provider access. Inventory every remote management tool and third-party connection. Separate client environments, and require multi-factor authentication and logging for provider sessions.
Sources: Incransom Ransomware Group Exfiltrates Sensitive Data from City of... | City of Princeton Ransomware Claim by INC (Oct 2026) | Personal information was among data taken from city systems, Prince... | City of Princeton — INCRANSOM Ransomware Attack Breach House | Incransom Exfiltrates 179GB from Managed IT Provider Onmion LLC, Co... | Incransom Targets Wavecrest HFA in Ransomware Attack - DeXpose | Data stolen in city cyberattack Princeton Herald | Council to take the city's data theft behind closed doors twice on...