A nationwide cyberattack has compromised the OnSolve CodeRED emergency notification system, prompting cities and counties across the United States to warn residents and advise password changes. CodeRED, widely used by local governments, delivers urgent alerts during severe weather, evacuations, missing persons, and other emergencies.

The cloud‑based platform enables agencies to send alerts via calls, texts, emails, mobile apps, and national systems. Following the attack, some regions temporarily lost access and relied on social media to reach the public. Importantly, CodeRED is distinct from the federal Emergency Alert System (EAS); it is a voluntary program where residents opt in to receive local alerts.

Municipalities such as Cambridge, Massachusetts, and University Park, Texas, issued advisories urging users to reset passwords, especially if reused elsewhere. Officials confirmed the incident was linked to a ransomware attack by the INC Ransom group, which claimed responsibility and leaked screenshots of stolen customer data, including email addresses and clear‑text passwords. Negotiations reportedly failed after the group rejected ransom offers from Crisis24, CodeRED’s provider.

In response, Crisis24 shut down its legacy environment and rebuilt the system on isolated infrastructure. Some jurisdictions, including Douglas County, Colorado, have since terminated their CodeRED contracts.

The breach underscores the dangers of storing passwords in clear text and highlights the risks communities face when critical alert systems are disrupted. Cyberattacks on platforms like CodeRED can delay life‑saving notifications, leaving residents vulnerable during emergencies.

Experts advise affected users to change passwords, enable two‑factor authentication, remain alert for phishing attempts, and consider identity monitoring services. While ransomware groups show little concern for public safety, protecting emergency communication systems is vital to ensuring communities receive timely alerts when minutes matter.