Apex Says Nearly 22,000 Residents Had Information Stolen in 2024 Cyberattack

What happened

Nearly 22,000 Apex residents had information stolen in a 2024 cyberattack, and the town said it has now recovered the data with help from the FBI and a court order. According to the town, about 22,000 residents may have had their data compromised in the July 2024 incident. The town announced on Monday that the stolen information had been secured and said the attacker stored town data within the cloud environment of Bublup, Inc. The town said Bublup, Inc. was not responsible for the attack, but it did not release the data back without a court order. Wake County Superior Court granted a Temporary Restraining Order on Oct. 10, 2024 requiring Bublup, Inc. to provide the town full and direct access to its data, allowing Apex to review and recover essential information. 

Who is affected

The direct exposure affects about 22,000 Apex residents whose personal information may have been involved in the July 2024 cyberattack. The town said it has since been analyzing the recovered data and working to identify and notify affected individuals. 

Why CISOs should care

This incident matters because it shows that recovery from a cyberattack may depend not only on technical response, but also on legal action to regain access to stolen data held in third-party cloud infrastructure. It also highlights the operational burden that follows when a municipality must analyze recovered data and notify affected individuals months after the initial intrusion. 

3 practical actions

1. Clarify cloud-recovery legal pathways: Make sure incident response planning accounts for situations where stolen data may sit in third-party cloud infrastructure and recovery may require immediate legal action. 
2. Prepare for long-tail breach analysis: Plan for the possibility that identifying affected individuals and reviewing compromised datasets may continue well after data is recovered. 
3. Treat municipal data recovery as a governance issue: Align legal, executive, and security teams early when public-sector data is stolen and access to that data becomes central to service continuity and resident protection. 

For more news about incidents involving exposure of personal information, click Data Breach to read more.