The TridentLocker ransomware group has listed Sedgwick Government Solutions on its data leak site and says it stole data from the company. Sedgwick Government Solutions is a Bethesda, Maryland contractor that handles claims and productivity management for federal employees and government agencies. Siberpol's Intelligence Unit tracked the listing and reports that the group claims to have taken 2,947 files, about 3.39 GB in total, and has posted download links to the archives. Only the attackers have described the breach so far. Sedgwick Government Solutions and its parent company Sedgwick have not commented publicly. No regulator filing or breach notification has been published, and no established security outlet has independently confirmed the intrusion or checked the leaked files.
What Happened
Siberpol says TridentLocker announced the listing on December 30, 2025, and that the group gives the same date for the attack itself. Siberpol's write-up is dated November 10, 2026. That gap means the data may have been posted for months before it was widely reported, or the dates in the tracking record are wrong. Readers should treat the timeline as unconfirmed.
The listing does not follow the usual "pay before the deadline" pattern. Siberpol reports that the group has already posted download links, so the claimed data is apparently available now. Siberpol also says little public information exists about TridentLocker's methods. The group cannot be tied to a known campaign, and its main pressure tactic appears to be publishing stolen data.
Sedgwick Government Solutions is a small company. A LinkedIn profile for one of its senior information security officers describes it as having 100 to 150 employees and $10M to $20M in annual revenue, with staff in the US and UK. The same profile shows the company's security work includes federal workers' compensation programmes. The parent company, Sedgwick, is much larger. Its current job listings describe more than 33,000 colleagues and 10,000 clients in 80 countries. No public information shows whether the claimed breach reached beyond the government subsidiary into the parent company's systems.
What Was Taken
TridentLocker's claims, as relayed by Siberpol:
- Volume: 2,947 files, about 3.39 GB
- Categories: IT infrastructure data, certificates and corporate documents
No one other than the group has stated a different file count or data volume, and nobody has independently checked the contents. The group has not specifically claimed to have personal data such as claimant records or Social Security numbers. Siberpol's description of the data categories is cut off in the available text, so additional claimed categories cannot be ruled out.
The categories that are listed still matter. IT infrastructure documents and certificates can help an attacker get back into a network. Infrastructure data can show network layout, hostnames and system dependencies. Stolen certificates, especially if private keys were included, can be used to impersonate services, sign malicious content or decrypt traffic until they are revoked and replaced.
Why It Matters
Contractors that process federal employee claims hold some of the most sensitive data the government has. A FedWeek legal analysis published on November 10, 2026 notes that federal personnel records can include Social Security numbers, financial data, employment history and background investigation material. It also notes that federal courts have recently examined how widely access to such systems is granted. A workers' compensation administrator may also hold medical and injury information.
The listing fits a wider trend. RackTop's 2026 government breach tracker cites Comparitech figures of 187 ransomware attacks on government organisations in the first half of 2026, 89 of them confirmed by the victims, up from 165 in the second half of 2025. RackTop also finds two recurring problems: attackers often get in through valid or borrowed credentials, including contractor accounts, and victims often cannot say exactly what was accessed. Both point to suppliers as a weak point. A small contractor connected to agency systems may have fewer security resources than the agencies it serves.
The Attack Technique
How TridentLocker got in, if it did, is unknown. The group has not described its access method, and neither the company nor any researcher has published technical findings.
Ransomware groups have been attacking government targets through publicly exposed collaboration servers, and defenders should keep that in mind. That activity has not been linked to this incident. SecurityWeek, reporting on Symantec research, says the Warlock ransomware operation, attributed to a China-based group tracked as Storm-2603, keeps exploiting on-premises Microsoft SharePoint flaws against government, education and critical infrastructure targets. These include the ToolShell bugs (CVE-2025-53770 and CVE-2025-53771) and possibly several 2026 SharePoint CVEs. Kaspersky's Securelist team documented a Storm-2603 intrusion in which the attackers ran their access tools entirely in memory inside the IIS worker process (w3wp.exe) and wrote nothing to disk. They then tried to disable endpoint security tools before attempting to deploy ransomware. Symantec reports that in one intrusion Warlock operators disabled security software on at least 40 systems and ran ransomware on at least 33 of them. Neither report mentions TridentLocker or Sedgwick.
What Organizations Should Do
- Assume certificates are exposed until proven otherwise. If you rely on certificates issued or managed by Sedgwick Government Solutions, or on trust relationships with it, ask for confirmation of which ones were affected. Revoke and reissue them where there is any doubt.
- Review third-party access now. Agencies and primes working with the contractor should check any VPN, single sign-on, API or shared-account access it holds. Rotate those credentials and watch for logins from unusual locations or at unusual times.
- Patch and inspect on-premises SharePoint. Apply all ToolShell and 2026 SharePoint fixes and rotate ASP.NET machine keys. Hunt for suspicious child processes and unusual .NET assembly loads under w3wp.exe, because disk-based scanning will miss in-memory implants.
- Alert on attempts to tamper with security tools. Treat any attempt to stop, unload or uninstall endpoint protection as a high-priority incident. In recent ransomware cases it has come just before encryption.
- Search leak sites for your own data. Organisations exchanging documents with the contractor should check whether their files appear in the published archives and prepare to notify anyone affected.
- Plan disclosure for when scope is unclear. Several 2026 government victims could not say what was accessed. Prepare notification plans and logging that can answer that question quickly.
Sources: Sedgwick Government Solutions targeted by TridentLocker ransomware... | How to detect fileless attacks exploiting ToolShell: analyzing the... | Warlock Expands SharePoint Exploitation in Critical Infrastructure... | Eloka Agajelu, CISSP, CISM | Government Data Breaches 2026: The Running List RackTop | Data Privacy Analyst | SOC Manager at Sedgwick | What Should Federal Employees Do If Their Personal Information Has...