Chambers of Commerce Hit by Hacking — Ransomware and Fake CAPTCHA

Ransomware crews and malware operators spent 2026 treating U.S. chambers of commerce like soft mid-market targets. AiLock publicly claimed the Dallas Regional Chamber; DragonForce listed the Tulsa Regional Chamber; and the Cuero Chamber of Commerce warned members after a fake “Are you a robot?” CAPTCHA told visitors to press Windows + R and Ctrl + V — a clipboard-paste info-stealer pattern tied to a Shopify event-registration path (Victoria Advocate, Feb 2026).

Chambers hold what attackers want: member directories, event payments, and a sender brand every local business already trusts. Fresh audit.emailmenow.com scores on August 1, 2026 show none of the related domains at the 100% ideal — and none of the public member portals we reviewed advertise YubiKey or Google Authenticator.

Snapshot

Ransomware claims are intelligence leads, not verified breach notices. Cuero is the exception: reporters quote chamber leadership and a member-facing warning.

Chronology

Dallas Regional Chamber — AiLock claim

Dallas is the region’s business-advocacy voice — economic development, education, public policy. A ransomware claim against that brand is a regional member-data risk even before any confirmed disclosure.

Tulsa Regional Chamber — DragonForce claim

DragonForce has been an active affiliate-driven ransomware brand since 2023, with heavy U.S. targeting in industry trackers. Same caveat as Dallas: a leak-site listing is not the same as a chamber press release.

Cuero — fake CAPTCHA, real keystrokes

Legitimate CAPTCHAs never open the Windows Run dialog or ask you to paste a hidden command. That pattern is the “ClickFix” / clipboard-paste class used to drop info-stealers. If you hit it: close the tab, disconnect, scan the device — same guidance from FTC / ITRC materials on this scam family.

Why chambers are attractive targets

Chambers sit at the intersection of member PII, event payment flows, and trusted bulk email. IBM / Ponemon’s Cost of a Data Breach Report 2026 found ransomware among 39% of breached organizations, with 41% of those incidents including brand / reputation threats (public shaming and media leaks) — the same pressure pattern as leak-site chamber claims.

Same trust problem as our chamber email-spoofing primer — now with ransomware and malware against the org itself.

Independent cybersecurity audits

EmailMeNow domain audits on August 1, 2026. 100% is the ideal overall score — none of these reach it. Scores measure public identity / transport / website posture. They do not prove or disprove a ransomware intrusion path.

Audit links: houston.org · austinchamber.com · cuerodc.com · dallaschamber.org · tulsachamber.com · cuero.org · okcchamber.com

Pattern: All 7 domains score 15% Transport Security — inbound mail transport (MTA-STS / related) is a sector-wide gap. Claimed ransomware victims Dallas and Tulsa sit at 50% overall (50 points under ideal). Peer Houston leads at 70% on strong identity (95%). Oklahoma City is the soft outlier at 32% with 0% identity.

How we graded MFA

Public member-login pages only — not a logged-in mystery shop of staff Microsoft 365 / Google Workspace. Methods change; re-check before you rely on this table. Same spirit as our national bank MFA scorecard.

Member portal MFA — YubiKey and Google Authenticator

cuerodc.com is an economic-development site without a comparable public member hub in this review — graded on domain audit + stack only.

Takeaway: None of these six member surfaces advertise YubiKey or Google Authenticator. Password-only portals next to 50% victim-domain scores (and a 32% OKC outlier) is a poor combination when ransomware crews and info-stealers already name chambers. Staff Microsoft 365 MFA — if enabled — does not protect the chamber hub that holds member contacts.

Website stack note

Passive website-tech probes on August 1, 2026 covered 7 story domains (1 notable):

Cuero’s public chamber site still fingerprints behind current WordPress after a malware-related incident — patching the membership CMS matters even when the lure arrived via a third-party Shopify path.

Cybersquat / lookalike scan

DoH lookalike scans on August 1, 2026 (registered-only; BEC profile):

Short brands like cuero.org sit in a crowded lookalike space with live-MX staging domains — useful for the next “chamber invoice” lure even when the original incident was CAPTCHA malware. Track registrations with Cybersquat Domain Monitoring.

Priority actions for chambers

1. Treat member data as high-value — offline/immutable backups; practice restore; segment membership CMS from finance workstations.
2. Harden member portals — require MFA; Google Authenticator–class TOTP at minimum; YubiKey / FIDO for staff and privileged roles.
3. Close email gaps — enforce DMARC; fix 15% transport (MTA-STS); share audit.emailmenow.com with members.
4. Review third-party event stacks — Shopify / ticketing iframes and CAPTCHA widgets need the same scrutiny as the homepage.
5. Train the never-Run-and-Paste rule — any CAPTCHA asking for Win+R / Ctrl+V is malware.
6. Monitor lookalikes — especially short city brands with live MX (cybersquat monitoring).

Related trackers

• IBM Cost of a Data Breach Report 2026
• Why chambers are prime email-spoofing targets
• Top Dallas chambers email security
• Top Oklahoma chambers email security
• National banks MFA — YubiKey vs Authenticator vs SMS
• WordPress WP2Shell RCE advisory

Sources: DeXpose — AiLock / Dallas Regional Chamber (Mar 3, 2026) · Ransomware.live — tulsachamber.com / DragonForce · Victoria Advocate — Cuero Chamber malware (Feb 2026) · Breachsense — Dallas ~1.3 TB indexer listing. Independent EmailMeNow domain audits, website-tech probes, cybersquat scans, and public portal MFA reviews August 1, 2026. Domain scores: audit.emailmenow.com only. Ransomware claims are actor-side unless the organization confirms.