✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Public Safety
Breach intelligence, attack campaigns, and threat reports targeting the Public Safety sector.
Explore Other Sectors
Public Safety Threat Reports
How the OnSolve CodeRED Cyberattack Disrupted America’s Emergency Alert Infrastructure
In June 2024, Crisis24 confirmed that its OnSolve CodeRED platform—used by state and local governments, police, and firefighting agencies—suffered a cyberattack disrupting emergency notification systems nationwide. Attackers gained unauthorized access to critical infrastructure, resulting in outages that hindered the timely dissemination of emergency alerts and public safety updates. While the investigation is ongoing, the breach demonstrates significant operational risks associated with service provider platforms in the public safety sector, impacting communities’ emergency preparedness and response effectiveness. This incident underscores growing threats targeting third-party vendors in critical sectors, where cyberattacks exploit platform dependencies to cause widespread and immediate disruption. With increasing regulatory scrutiny and a surge in ransomware and extortion campaigns against essential services, organizations must reassess supply chain, segmentation, and incident response controls to maintain operational and compliance resilience.
6 months ago
Kill Chain
SiRcom Vulnerability Exposes Critical Siren Systems to Hijack (2025)
In November 2025, a critical vulnerability (CVE-2025-13483) was disclosed in SiRcom SMART Alert (SiSA), a central emergency alert management system used globally in emergency services, government, and defense sectors. The flaw, due to missing authentication for critical API functions, enabled unauthenticated attackers to access restricted backend operations. Successful exploitation could allow remote manipulation and activation of emergency sirens, posing wide-reaching operational and safety risks to affected communities. The vulnerability, assigned a CVSS v4 score of 8.8, was initially reported by Microsec researcher Souvik Kandar. This incident highlights the persistent risks posed by missing authentication in critical infrastructure applications. With remote exploitation possible and attackers’ interest in manipulating physical environments on the rise, it underscores the urgent need for robust authentication, especially amid compliance and regulatory tightening in the critical infrastructure sector.
6 months ago
Kill Chain
How Ransomware Crippled Nevada State Agencies in 2025
In August 2025, the State of Nevada experienced a significant ransomware attack that disrupted the operations of over 60 state agencies, including those responsible for health and public safety. Attackers gained unauthorized access to internal systems, likely through a compromised credential or exposed remote access service. They rapidly deployed ransomware across the network, encrypting critical data and rendering multiple state services inaccessible while officials initiated emergency response protocols. The impact included delayed or suspended services for residents and a comprehensive recovery process lasting several weeks. This incident underscores a persistent trend: ransomware threat actors are increasingly targeting government entities, leveraging lateral movement and broad access to cripple essential public services. As attacks escalate and recovery costs rise, organizations face greater pressure to modernize segmentation, detection, and incident response strategies.
6 months ago
Kill Chain
IDIS ICM Viewer 2025: Critical Application Vulnerability Risk Exposed
In November 2025, IDIS disclosed a critical vulnerability (CVE-2025-12556) in its ICM Viewer application, enabling remote attackers to execute arbitrary code via improper neutralization of argument delimiters—a classic argument injection flaw. The vulnerability, scored CVSS v4 8.7, affected version 1.6.0.10 and allowed exploitation through low-complexity attacks requiring only limited privileges. The flaw could provide adversaries with broad control over vulnerable systems, directly impacting critical communications infrastructure deployed worldwide and potentially undermining operational continuity and data integrity. This incident highlights the growing risk posed by supply chain and application-layer vulnerabilities in industrial and communications networks. The prevalence of remote, low-complexity exploits underscores the urgent need for robust patch management and defense-in-depth approaches, especially as regulators intensify scrutiny of critical infrastructure cybersecurity.
6 months ago
Kill Chain
Ransomware Surge Hits State & Local Agencies: Lessons from Nevada and St. Paul
In August 2024, both the State of Nevada and the City of St. Paul, Minnesota, experienced disruptive ransomware attacks that resulted in significant outages and data theft. Attackers exploited gaps in cybersecurity readiness and funding reductions to compromise critical municipal systems, leading to the shutdown of public services and exfiltration of sensitive information. Incident response efforts included engagement with federal agencies like the FBI and CISA, although full recovery remained ongoing for several weeks and required costly investigations, with losses projected to reach $17 million for St. Paul alone. These incidents illustrate the rising threat to smaller government entities, exacerbated by declining federal cybersecurity resources. The sophistication and operational impact of ransomware attacks continue to increase, underscoring urgent calls for improved resilience, incident response planning, and investment in cyber hygiene—especially amid tightening budgets and evolving threat tactics.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports