South Weber City Data Breach

Booba Project added South Weber City to its leak site on October 29, 2026, a listing that SOCRadar identified through dark web monitoring of the group’s extortion site. South Weber is a municipal government in Davis County, Utah, providing public works, parks, and community planning services to residents through its official domain, southwebercity[.]gov. The listing fits within a sustained focus by Booba Project on US local government entities. Small American municipalities hold meaningful administrative and resident data while generally operating with limited IT resources, characteristics that have made them a recurring and practical target for ransomware and extortion groups. Over the previous 60 days, Booba Project has claimed 32 victims, with the United States, Canada, and Pakistan emerging as its leading victim countries. The group’s activity shows a persistent focus on the Government & Defense, Healthcare, and Education sectors. Small and mid-sized municipal governments are a consistent segment of this targeting, and Booba Project has listed municipal governments of comparable scale before. South Weber fits the pattern exactly, making this listing consistent with the group’s posture rather than an anomaly.

SOCRadar’s stealer-log telemetry query for southwebercity[.]gov returned no records, indicating that no credentials associated with the city’s primary domain were identified in the queried infostealer dataset. A result of this kind does not confirm that the organization is unaffected; the absence of evidence is not evidence that no compromise occurred. Coverage of small municipal domains is frequently incomplete in stealer-log collections, and exposure through contractor accounts or SaaS platforms used by city staff may not appear in available datasets. For a small municipal government, these blind spots are particularly relevant, since staff and vendor activity often extends well beyond the domain used for public services. The Booba Project entry does not describe the data being claimed or the technique used to obtain access. Because the stealer-log query returned no records for southwebercity[.]gov, there is no direct correlation between the listing and any observed credential exposure, and no specific initial-access method can be confirmed from the available telemetry. This does not rule out compromise: credentials harvested through infostealer infections tied to contractor accounts or SaaS platforms used by city staff would not surface under a query of the city’s public-facing domain, so relevant exposure may exist outside the sampled data. Such records could inform how an actor gained or validated access, meaning the coverage gap should be treated as a monitoring limitation rather than evidence of a clean environment. Given these limitations, continued dark web and stealer-log monitoring is the primary measure, particularly for records tied to southwebercity[.]gov that may surface as the listing develops. Proactive credential-hygiene checks are also advisable, including password rotation and a multi-factor authentication review, with particular attention to contractor accounts and SaaS platforms used by city staff, where exposure would not be captured by a domain-based query. The city should also track Booba Project’s leak site for updates on the claimed data.