Crisis24 CodeRED Cyberattack: U.S. Emergency Alert System Goes Down After Major Hack
What Happened to CodeRED?
Early November 2025 brought a major shock to the U.S. emergency alert ecosystem. Hackers targeted Crisis24’s OnSolve CodeRED platform, the same system used nationwide by police departments, fire agencies, and local governments to send emergency notifications.
When the attack hit, Crisis24 had no option but to shut down the old CodeRED system, leaving many communities unable to receive urgent alerts like: Weather warnings, Evacuation notices, Missing person alerts, Public safety warnings. In short, the core alert system millions relied on suddenly went dark.
Hackers Stole Sensitive User Data
According to Crisis24, the hackers only targeted CodeRED’s environment, not other systems. But this didn’t stop the attackers from stealing highly sensitive information, including Names, Addresses, Email, Phone numbers, and even plain-text passwords used for logging into CodeRED profiles Yes, you read that right, passwords were found in plain text, which is a major security red flag.
Who Was Behind the Attack?
Although Crisis24 publicly referred to the hackers only as “organized cybercriminals,” further investigation by cybersecurity reporters revealed the real culprit:
The INC Ransomware Gang
This group isn’t new. Since emerging in July 2023, INC ransomware has attacked organizations across multiple industries, including:
- Education
- Healthcare
- Government units
- Corporations like Yamaha Motor Philippines
- Scotland’s NHS
- Food retail giant Ahold Delhaize
- Xerox Business Solutions (U.S.)
Their message is clear: they aren’t targeting any single industry – they’re going after everyone.
Why This Attack Is a Big Deal?
- Public Safety at Risk
- Personal Data Exposure
- Critical Infrastructure is Vulnerable
What Crisis24 Is Doing Now?
Crisis24 has introduced a newer version of CodeRED under a separate secure environment. While essential services are gradually being restored, many advanced features are still offline.
It may take weeks – or even months – before everything is fully functional again.
The CodeRED attack is a reminder that cybersecurity is now a core part of public safety. When emergency alert systems get compromised, it’s not just data at risk; lives can be affected.
This incident is a wake-up call for government agencies, local authorities, and cybersecurity teams worldwide to strengthen protections around critical infrastructure.
Found this article interesting? Explore more ransomware security insights and threat updates.
Frequently Asked Questions (FAQs)
CodeRED is an emergency alert system used by police, fire departments, and local governments in the United States. Whenever there’s a threat, such as severe weather, a fire, an accident, or another major incident, people receive immediate alerts through it.
Hackers launched a cyberattack on the CodeRED platform, bringing the entire system to a standstill. Crisis24 had to completely shut down the old system for security reasons. As a result, many agencies were unable to send alerts, nor were people receiving important notifications.
The INC Ransomware Gang has claimed responsibility for this attack. Initially, Crisis24 simply described them as “organized cybercriminals,” but later reports clarified that the attack was carried out by the INC group.
Crisis24 has launched the new CodeRED system, but many features are still down. The ability to send basic alerts is slowly returning, but it will take some time to fully return to normal.
Call Now — 24/7 Ransomware Help
If you’re under attack, call now. We’ll start safe containment, preserve evidence, and stand up a clean landing zone. No contracts required to start.
Call 316‑712‑4006
I am at risk, Save me!