The City of Princeton is under scrutiny after a ransomware group publicly claimed to have infiltrated its IT systems and stolen a significant amount of sensitive municipal data. City officials say two independent cybersecurity reviews have so far turned up no evidence of unauthorized access.
In an official statement the city said neither review has identified a confirmed data breach or unauthorized data exfiltration based on information currently available. Despite that finding the investigation remains active and ongoing.
The ransomware group is claiming it obtained a complete backup of the city’s internal file server containing more than 20 departmental folders covering every branch of municipal operations. Cybersecurity expert Matt Barnett with the firm SEVN-X says the group alleges it holds nearly two gigabytes of data including more than 13,000 residential addresses and over 2,500 new residential accounts.
The group also claims to possess delinquent account records credentials to city systems court records and forensic copies of devices including the mayor’s phone. Barnett says the attackers have given the city a 10-day window to make contact before they begin releasing the data publicly.
A key step in any ransomware investigation is what experts call proof of life which involves verifying whether the attackers actually possess the data they claim to have. Barnett noted that in his experience negotiating ransomware payments threat actors rarely claim to have data they cannot later verify.
During a special city meeting Monday night Mayor Eugene Escobar Jr. addressed a resident who asked whether the community remains at risk. The mayor said there is currently no evidence that anything posted online is accurate regarding a breach but declined to elaborate further.
Barnett cautioned that without direct access to the internal investigation it is impossible to know the full scope of what may have been affected. He acknowledged the situation warrants serious attention given the specificity of the group’s claims.
City officials emphasized that essential services will continue to operate normally while investigators work to determine the full extent of what occurred. Princeton joins a growing list of municipalities across Texas that have faced increasing pressure from ransomware groups targeting government infrastructure.