Cybersecurity Incident Prompts Emergency Alert System Transition in St. Mary’s County – Conduit Street
Publish Date: 2026-02-12 15:51:00
Source Domain: conduitstreet.mdcounties.org
The St. Mary’s County Government (SMCG) Department of Emergency Services (DES) has provided an update regarding the previously reported cybersecurity incident involving the CodeRED Emergency Notification System – a third-party platform used by local governments nationwide to issue emergency alerts.
What Happened
CodeRED has completed a forensic investigation, conducted by internal security teams and external cybersecurity experts, into the incident that led to the suspension of the legacy platform in November 2025. According to CodeRED, an organized cybercriminal group gained unauthorized access to the legacy OnSolve CodeRED environment beginning as early as October 31, 2025, and deployed ransomware on November 10, 2025. The attack resulted in the encryption of certain servers and significant damage to the legacy system. While a data transfer tool was identified during the investigation, forensic experts found no evidence confirming that data was exfiltrated from the system.
Limited Subscriber Information Affected
CodeRED reports that limited subscriber information affecting a small percentage of users was exposed across two data sets:
- One data set contained usernames, phone numbers, and inactive, outdated passwords that were deactivated and changed in 2015 during a prior platform migration.
- A second data set contained usernames with encrypted passwords that are unreadable and not identifiable. There is no evidence that encryption keys were accessed.
Importantly, CodeRED has confirmed that the exposed data did not include first or last names, addresses, or other sensitive personal information, and did not include any active passwords. While residents were initially encouraged to change passwords out of an abundance of caution, updated guidance confirms that no active passwords were compromised. Residents are still advised to remain vigilant and cautious of unsolicited communications requesting personal or financial information.
