CodeRED has completed a forensic investigation, conducted by internal security teams and external cybersecurity experts, into the incident that led to the suspension of the legacy platform in November 2025.
What Happened
According to CodeRED, an organized cybercriminal group gained unauthorized access to the legacy OnSolve CodeRED environment beginning as early as October 31, 2025, and deployed ransomware on November 10, 2025. The attack resulted in the encryption of certain servers and significant damage to the legacy system.
While a data transfer tool was identified during the investigation, forensic experts found no evidence confirming that data was exfiltrated from the system.
Information Potentially Exposed
CodeRED reports that limited subscriber information affecting a small percentage of users was exposed across two data sets:
One data set contained usernames, phone numbers, and inactive, outdated passwords that were deactivated and changed in 2015 during a prior platform migration.
A second data set contained usernames with encrypted passwords that are unreadable and not identifiable. There is no evidence that encryption keys were accessed.
Importantly, CodeRED has confirmed that the exposed data did not include first or last names, addresses, or other sensitive personal information, and did not include any active passwords.
Updated Guidance for Residents
Based on the findings of the investigation, CodeRED advises that no active passwords were compromised. While residents were previously encouraged to change passwords out of an abundance of caution, the newly confirmed information indicates that exposed passwords were inactive and outdated.
Residents are still encouraged to remain vigilant and cautious of unsolicited communications requesting personal or financial information.
Emergency Alert System Update
As previously announced, the legacy OnSolve CodeRED platform has been permanently decommissioned. On January 6, 2026, the Commissioners of St. Mary’s County approved a new emergency notification system, Regroup Mass Notification, following review and recommendations by the Departments of Emergency Services and Information Technology. Additional information on this transition and the new system will be announced soon.
St. Mary’s County Government remains committed to transparency and to safeguarding the safety, security, and privacy of the community.
Residents with questions or concerns about this
incident or about emergency notifications in St. Mary’s County may contact DES at EMA@stmaryscountymd.gov or (301)-475-4200 ext. 2125.
###
