City of McMinnville Data on Dark Web Following Ransomware Attack – Personnel, Investigation Victims, and Internal Affairs Files Compromised

Police files, personnel records and other sensitive city documents alleged among leaked data

By Rebecca Wallis
McMinnville, OR – September 16, 2026

Records belonging to the City of McMinnville have appeared on the Tor network following a ransomware attack claimed by the group RansomHouse. Yamhill County News has reviewed material associated with the release, along with publicly available ransomware-tracking information.

The records appear to include a large amount of city data, including material connected to city computers, email accounts, elected officials, executive sessions and McMinnville Police Department systems. Yamhill County News will not publish the leaked files or provide information directing readers to where the material can be found.

The City of McMinnville has not publicly described the full scope of the breach or identified what personal, personnel or law-enforcement information may have been compromised. The FBI declined to comment.

Timeline of the ransomware release

Public ransomware-tracking sites began showing RansomHouse listing the City of McMinnville in early August. Tracking records place the public listing around Aug. 3 through Aug. 6, with sample files appearing around Aug. 6 and a larger release marked as disclosed around Aug. 9 or Aug. 10. Previous local reporting of the News-Register has described the original cyberattack as occurring in July.

The City of McMinnville has not publicly confirmed the exact date of the attack or when city officials first determined information had been taken. Yamhill County News reviewed information associated with the ransomware release, which appears to include records from city desktop computers, city email accounts, elected officials and the McMinnville Police Department. Some police-related material appears to involve criminal investigations spanning multiple years.

People familiar with the contents of the leaked data, who are not authorized to speak publicly and whose identities are being withheld by Yamhill County News, say the material includes:

• Files from city computers, including McMinnville Police Department workstations
• Encryption-related material
• Folders described as containing passwords or credentials associated with law-enforcement systems, including CJIS and LEDS
• Unredacted records from past and active criminal investigations
• Police reports, photographs, video and audio
• Employee disciplinary records
• Employee internal investigation files
• Anonymous-tip records containing information that could identify the people who submitted the tips
• Information identifying victims connected to active investigations; to include photos, audio, and video
• Personnel files that include medical information, addresses, and phone numbers

The City of McMinnville and federal authorities have not confirmed those descriptions. Yamhill County News has witnessed files in each of those categories but has also not independently determined the total size of the leaked archive.

Sources familiar with the material have claimed the release is approximately 300 terabytes. That figure has not been verified and would represent an unusually large amount of data for a city the size of McMinnville.

Person involved in active investigation contacts Yamhill County News

Yamhill County News has also been contacted by a person who said she is involved in an active investigation and is concerned that her personal information may be included in the released records. The newsroom has not confirmed whether her information is contained in the leak and is not identifying her.

Police chief hiring file included in material

Yamhill County News reviewed a document that appears to be an executive summary connected to the city’s police chief hiring process. The document appears among material associated with the ransomware release and contains personnel-related information.

Yamhill County News will not publish the document, reproduce psychological evaluation information or disclose sensitive personnel information contained within the record. The City of McMinnville has not confirmed what personnel files were taken or released.

Internal investigation involving councilor alleged among leaked files

McMinnville City Councilor Dan Tucholsky, who also served as a reserve police officer, was arraigned this week in Yamhill County Circuit Court on domestic violence charges. He has pleaded not guilty. The criminal case and arraignment are matters of public record.

Separately, people familiar with the ransomware files say the leaked material contains records from an internal investigation involving Tucholsky during his time as a reserve police officer. Sources familiar with the records allege the investigation involved ethical concerns and a DUII traffic stop.

Those sources further allege the investigative material references a Yamhill County Sheriff’s Office deputy, other McMinnville police officers and an employee of the Yamhill County District Attorney’s Office who was reportedly in the vehicle during the stop.

Yamhill County News has not independently verified the contents of that investigative file. The City of McMinnville, Yamhill County Sheriff’s Office and Yamhill County District Attorney’s Office have not confirmed the existence or circumstances of the investigation described in the leaked material.

Yamhill County News will not publish the identities of alleged crime victims, anonymous tipsters or private individuals whose information appears in the leaked records.

City has not commented on scope of breach

Yamhill County News contacted the City of McMinnville seeking information about the ransomware attack, the apparent release of police and personnel records and what steps are being taken to notify or protect people whose information may have been compromised. The city has not provided a response.

Yamhill County News also contacted the FBI on September 13th regarding the attack and the apparent release of McMinnville Police Department records. On September 14^th, the FBI declined to comment.

People familiar with the city’s handling of the incident have also alleged that FBI personnel and investigators with the Cybersecurity and Infrastructure Security Agency, commonly known as CISA, were turned away while the city conducts its own investigation. Yamhill County News has not independently confirmed that account, and the City of McMinnville has not responded to questions regarding federal involvement in the investigation.

Oregon law requires breach notification

Oregon law generally requires organizations that discover a breach involving personal information to notify affected consumers as quickly as possible and generally no later than 45 days after discovering the breach. If more than 250 Oregon residents are affected, notification to the Oregon Attorney General is also generally required.

Yamhill County News has not located a publicly available consumer notification or Oregon Department of Justice breach filing from the City of McMinnville related to this incident. Whether the 45-day notification period has expired depends on when the city determined personal information had been acquired during the attack. The city has not disclosed that date.

Public reporting and sources familiar with the incident have placed the city’s knowledge of the attack as early as July. The RansomHouse listing became public in early August.

If the city determined in July that protected personal information had been acquired, the 45-day notification period could already have passed. If the city considers the discovery date to have occurred later, including around the time of the August ransomware listing, the timeline could be different. Yamhill County News has not been able to determine whether a law-enforcement agency requested that notification be delayed.

What Yamhill County News will not publish

The leaked material may contain extremely sensitive information, including records involving crime victims, police informants, anonymous tipsters, city employees and people connected to active criminal investigations. Yamhill County News will not publish the leaked files, passwords, encryption keys, law-enforcement credentials or other information that could compromise city or police systems.

Yamhill County News will also not provide links, directions or instructions for locating the stolen records. The existence of the leak and the type of information potentially exposed, however, are matters of significant public concern, particularly for residents whose private information may have been stored within city or police records.

Anyone who believes their personal information may have been compromised should monitor financial accounts and credit reports and may consider placing a fraud alert or credit freeze with the major credit bureaus. Suspected identity theft can also be reported to law enforcement and the Federal Trade Commission. Questions regarding Oregon’s data-breach notification requirements can be directed to the Oregon Department of Justice.

This is a developing story. Yamhill County News will update this report as additional information is verified and if the City of McMinnville, law-enforcement agencies or federal authorities provide additional information.

Photo Credit: Yamhill County News File