Wednesday, DECEMBER 3, 2025 |
Photo – Carbon County Official Seal – Bigfoot99 file photo
A cyberattack has shut down the county’s former emergency alert system.
During Tuesday’s Board of Carbon County Commissioners meeting, IT Director Matt Webster announced that the OnSolve CodeRED emergency alert platform was recently compromised by a ransomware group. IT Director Webster said OnSolve’s cyber security was insufficient, allowing the group behind the attack, The Inc, to obtain users’ personal data and passwords.
Similar to AlertSense, Carbon County’s current emergency notification system, OnSolve CodeRED, sends alerts and warnings for city, county, and state government agencies.
Commission Chairman Travis Moore asked if Carbon County had used CodeRED in the past. IT Director Webster replied that, to the best of his knowledge, the system was used by the county and the City of Rawlins sometime before 2020, when Emergency Manager Lenny Layman was hired.
Since that time, the entire county has switched to the AlertSense platform. However, several Colorado municipal governments were still using the CodeRED system. Webster said anyone who signed up for notifications from OnSolve CodeRed should know that their data has most likely been stolen.
Webster said the ransomware group gained access to the CodeRED system on November 1st. By the 10th, all the platform’s data has been encrypted. According to several sources, The Inc originally demanded $950,000 to return the data but later lowered the price to $450,000. Crisis24, the parent company of OnSolve CodeRED, reportedly countered with offers of $100,000 and then $150,000. However, both proposals were rejected.
IT Director Webster reported that the CodeRED system was shut down, meaning anyone still using the platform will no longer receive emergency notifications. Instead, Webster and Emergency Manger Lenny Layman encouraged Carbon County residents to enroll in AlertSense.
IT Director Webster said the CodeRED incident serves as an important reminder not to reuse the same password across multiple websites and to enable multi‑factor authentication when available.
