Backups could not answer the D.C. police data leak

The week

Around April 26, 2021, the Babuk ransomware group posted on its leak site that it had stolen a large volume of data from the Metropolitan Police Department in Washington, D.C., and threatened to release information about informants to criminal gangs unless it was paid. The department confirmed it was aware of unauthorized access to its server and that the FBI was investigating. After negotiations failed, the group published files in May that included personnel and disciplinary records of officers. Around the same time, Babuk said it would stop encrypting victims’ systems and focus on stealing and publishing data. The incident was among the most serious data extortion attacks on a US police agency to that point.

Early ransomware planning centered on encryption: restore from backups and you need not pay. The D.C. incident showed why that plan was incomplete. The pressure came from stolen data, and backups do nothing about disclosure. Payment logic changes too. When systems are encrypted, a payment buys a key that either works or does not. When data has been stolen, a payment buys only a promise of deletion from a criminal group that cannot prove it and has every reason to reuse the data. Responders and law enforcement have warned repeatedly that such promises are unreliable, and public agencies face added political, legal and sanctions constraints on paying at all. The department did not meet the demand, and the files were published. Planning should assume that outcome.

That leaves one question: which data would cause harm if published, and to whom? Agency data falls into three categories with different owners and consequences: workforce data, operational data, and data held about the public.

Workforce data: harm to employees

The files Babuk published included personnel and disciplinary records. For any agency, this category covers background investigations, medical and leave records, performance and discipline files, payroll and tax forms, and home addresses. In law enforcement, disclosure can put officers and their families at risk. It also affects labor relations, since disciplinary records may be subject to collective bargaining terms on retention and access.

This data usually lives in human resources systems, payroll platforms and shared drives that get less security attention than mission systems. It is also commonly over-retained. Old background files and closed investigation records sit on file servers long after any business need, often because nobody is sure who may delete them. Two controls matter most. Retention schedules that are actually enforced reduce exposure directly, because records that no longer exist cannot be stolen. And HR, legal and the security team need a pre-agreed plan for telling employees what was taken and offering protection, since staff will learn about a leak from the press if the agency is slow.

Operational data: harm to the mission

The threat to expose informants pointed at the most sensitive category: information whose release would compromise investigations or endanger people who cooperate with the agency. In a police department, that means informant identities, intelligence files and case materials. Other agencies have equivalents: fraud investigation files at a revenue department, child welfare case notes, protective details in emergency management plans.

Criminal justice information carries specific requirements under the FBI’s CJIS Security Policy, including access control, audit logging and encryption, for agencies and contractors that access it. Compliance with that policy is necessary but does not stop copies spreading. Exports to spreadsheets, printed reports scanned back in, and working files on personal drives often live outside the systems the policy was applied to. The useful exercise is to trace where the most dangerous records actually end up, then shrink that footprint.

Detection belongs here, because this is the data an attacker most wants and the agency can least afford to lose. Exfiltration usually happens days before any visible attack. Monitoring for large or unusual outbound transfers, especially from file servers and records systems to cloud storage services, gives a chance to stop theft before the leak site appears. Many agencies watched closely for encryption behavior and barely at all for data leaving.

Data about the public: harm to residents

The third category covers victims, witnesses, applicants, taxpayers and benefit recipients. Disclosure triggers state breach notification laws and, depending on the data, other obligations. It also damages public trust in ways that affect cooperation with the agency for years. A witness who learns their statement was posted online may not come forward again.

For most agencies this is the largest and most dispersed category, spread across line-of-business applications, document management systems and email. Much of it is held by contractors and software providers, so the agency’s exposure includes its suppliers’ security. Contracts should require notice of a supplier incident within a defined period and cooperation in identifying affected residents.

Collection is the other lever. Many agency forms still ask for Social Security numbers, dates of birth and full addresses where a case number or partial identifier would do. Each unnecessary field enlarges what a thief can publish and what the agency must notify about. A review of intake forms and database fields, asking whether each sensitive element is needed and for how long, is unglamorous work. It is also one of the few controls that reduces harm even after every other defense has failed.

The response plan needs a disclosure track alongside the recovery track. Someone must assess what was taken and whose it was, decide on notifications under each applicable law, prepare call center scripts, and decide how the agency will respond publicly to a leak site posting. Those roles sit with legal, privacy and communications, not only IT. Agencies that rehearse ransomware only as a restoration exercise leave this track untested.

With hindsight

From 2026, the D.C. incident looks like an early marker of a lasting shift. Extortion based on stolen data, with or without encryption, became standard criminal practice. The clearest case came in 2023, when the Clop group exploited a flaw in the MOVEit Transfer file-sharing product to steal data from a very large number of organizations without deploying ransomware; state agencies, including motor vehicle departments holding records on millions of residents, were among those affected. Law enforcement agencies continued to be targeted. Many agencies improved backup and recovery after 2021, which reduced the pressure encryption alone could apply, and attackers leaned harder on disclosure. Agencies that know where their workforce, operational and public data live, and how long they keep it, can make faster decisions when a leak site names them.