The City of Sandstone, Minnesota has notified residents that an April 2026 ransomware incident exposed Social Security numbers, financial account details, and other sensitive personal information. Russia-based ransomware gang Qilin claimed responsibility on May 4, 2026, listing the city on its data leak site, though officials have not formally acknowledged the attribution.
What Happened
On or about April 8, 2026, Sandstone city officials detected disruptions across municipal computer systems and quickly determined the cause was a ransomware incident. The city's breach notice acknowledges that "due to the nature of ransomware, it is possible that private data may have been accessed by the perpetrators of the incident."
Qilin took public credit for the intrusion roughly four weeks later, on May 4, 2026, adding Sandstone to its data leak site. The city has not disclosed how many residents were notified, whether a ransom was paid, the amount demanded, or how attackers initially gained access to the network. Free credit monitoring is being offered to affected individuals via [email protected].
What Was Taken
The breach notification confirms that the following categories of personally identifiable information (PII) were compromised:
- Full names
- Social Security numbers
- Financial account numbers and routing numbers
- Home addresses
- Dates of birth
This combination represents a high-value identity theft package. With SSNs paired against bank routing and account numbers, victims face elevated risk of synthetic identity fraud, tax refund fraud, and unauthorized ACH transfers. The inclusion of dates of birth and addresses further enables knowledge-based authentication bypass at financial institutions.
Why It Matters
Sandstone is the latest small US municipality to be added to Qilin's victim list, reinforcing a broader pattern of ransomware operators targeting under-resourced local government entities. Qilin has claimed 557 attacks in 2026 to date, with 46 confirmed by victim organizations. Eight of those confirmed hits struck government entities, including three US targets prior to Sandstone: Tulsa International Airport (January), the City of Seal Beach and its police department (March), and Rusk County, Wisconsin (March).
Comparitech researchers have logged 22 confirmed ransomware attacks on US government bodies so far in 2026, with April alone producing confirmed incidents tied to Interlock, SafePay, and other crews. The cumulative effect is sustained pressure on civic IT environments that frequently lack the staffing and budget of comparably sized private organizations.
The Attack Technique
Sandstone officials have not disclosed the initial access vector used in this breach. However, Qilin's operational profile offers useful context for defenders. The group operates a ransomware-as-a-service (RaaS) model, renting its encryptor and infrastructure to affiliates in exchange for a share of paid ransoms. Phishing emails are the group's predominant initial access method, often paired with credential theft, exploitation of exposed remote services, and abuse of valid accounts to move laterally and stage double-extortion data theft prior to encryption.
Qilin has been active on data leak sites since late 2022 and is widely tracked as a Russia-based operation. Affiliates have historically used legitimate administration tools (LOLBins), Cobalt Strike, and remote management software to maintain persistence and avoid detection on victim networks.
What Organizations Should Do
Municipal IT teams and other small public-sector defenders should treat the Sandstone incident as a prompt to revisit core ransomware controls:
- Harden email and identity: Enforce phishing-resistant MFA on all administrative accounts, deploy DMARC enforcement, and tune email security gateways to block macro-enabled attachments and ISO/LNK lures commonly used by Qilin affiliates.
- Reduce external exposure: Inventory and patch all internet-facing services, with priority on VPN appliances, RDP, and remote management tools known to be exploited by RaaS affiliates.
- Segment and monitor: Network-segment finance, HR, and resident data systems away from general workstations, and deploy EDR with behavioral detections tuned for Cobalt Strike, credential dumping, and mass file encryption.
- Test offline backups: Maintain immutable, offline backups of critical municipal records and perform routine restoration drills, assuming attackers will attempt to delete or encrypt connected backup repositories.
- Prepare for double extortion: Build an incident response playbook that explicitly addresses data leak site exposure, including legal, communications, and resident notification workflows aligned with state breach laws.
- Coordinate with CISA and MS-ISAC: Engage the Multi-State Information Sharing and Analysis Center for free monitoring services and report incidents to CISA to support broader sector defense.
Sources: Sandstone, MN says SSNs and financial info compromised in ransomware data breach - Comparitech