Alabama Board of Nursing
Alabama Board of Nursing ransomware incident
Summary
Ransomware disrupted Alabama Board of Nursing licensing and regulatory services Sept. 1, 2026, forcing paper applications and verification workarounds. Online single-state RN/APRN renewals reopened Oct. 15, but monitoring reports still required paper forms Oct. 21. The board confirmed downloaded data; the full exposure scope and attacker remain unresolved.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
-
Data theft or exfiltration
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Operational impacts
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Downstream organization impact
The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
The Alabama Board of Nursing experienced a ransomware incident that disrupted licensing and regulatory services beginning Sept. 1, 2026. Its Oct. 2 event notice described suspicious server activity in August and malicious activity through Sept. 1. The board took systems offline and engaged outside investigators. The August finding does not establish an exact intrusion-start date.
The board confirmed that some data was collected and downloaded. Its Oct. 2 press release said sensitive personal or protected health information may have been exposed. Possible categories included licensee names, birth dates, Social Security and driver’s license numbers, licensing information and medical information. Those possible categories do not establish that every licensee or every listed field was affected.
Operational significance
The disruption affected statewide nurse licensing during a renewal period involving more than 80,000 registered nurses. New graduates, out-of-state nurses and advanced-practice applicants faced manual processing while employers used Nursys and the board’s authorization list for verification. We reported that delayed licensing also affected health care hiring.
Staff collected new-license applications at community colleges Sept. 21-22 for processing in Montgomery. RN renewals remained on hold without a paper option. The collection sites are not evidence that the colleges’ systems were compromised. Probation and Voluntary Disciplinary Alternative Program monitoring applications were also unavailable; drug-screening requirements continued.
WHNT reported Oct. 12 that North Alabama Medical Center was using paper applications and fax processes for licensing checks. Communications Director Shane Herrmann said the added administrative work had not reduced nurse onboarding or significantly delayed hiring, and patient care and safety were unaffected. This documents downstream administrative disruption without establishing interruption of hospital care.
Current status
The board reopened online renewals for single-state registered nurses and advanced practice registered nurses Oct. 15. Executive Officer Natalie Baker described a new licensing management system and payment vendor. The board’s homepage confirms the reopening. This restored an important licensing function without establishing recovery of every service.
The board’s monitoring guidance continued to list monthly self-reports and quarterly employer, aftercare and counselor reports as unavailable when observed Oct. 29. It directed paper reporting and extended the Oct. 5 monthly and Oct. 10 quarterly deadlines to Oct. 31. Its application instructions still directed new applicants to paper forms, although their blanket statement about unavailable online services had been superseded for renewals. A final restoration date remains unestablished.
WAFF reported Oct. 21 that officials had processed 3,000 paper licenses since Sept. 1 and expected initial-exam applications to be the next portal restored. Huntsville Hospital said temporary licensing procedures caused minor application-processing delays without affecting nurse staffing or patient care. Other portals and applications remained under restoration.
The board’s notice to continuing-education providers says it cannot accept uploads of continuing-education data. An emergency rule temporarily waives documentation before renewal through Jan. 21, 2027; providers must keep attendance rosters and may issue completion certificates. Provider applications remain available by mail.
AL.com reported Oct. 22, in a GovTech syndication, that about 60,000 single-state nurses must renew by Dec. 1 and that the deadline had not been extended. Administrative Director Honor Ingels said renewals were proceeding, with initial-exam applications expected to return next. The report did not establish full restoration.
Disclosure posture
The board directly acknowledged the service disruption and later disclosed ransomware and downloaded data. It said it was cooperating with the FBI and Alabama Law Enforcement Agency and would provide further notices as its review developed.
Confidence and uncertainty
Confidence is high in cyber causation, ransomware involvement and data theft because the board confirmed those findings. The scope of sensitive-information exposure remains uncertain. The public record does not identify an actor, ransom demand, payment, public data release or encryption inventory.
Analytic gaps
The initial access route, exact intrusion date, compromised accounts and hosts, malware family, affected-person count, complete downloaded-data inventory, recovery cost and final restoration date remain unknown.
For the November reporting cycle, the board’s monitoring guidance extends the monthly self-report deadline from Nov. 5 to Nov. 13, 2026. Participants must submit paper forms directly to the board while monthly and quarterly online monitoring reports remain unavailable. Drug-screening requirements continue. The board says instructions for quarterly reports due in January 2027 will follow; this is continuing manual processing, rather than restored online reporting.
Organizations involved
Impacted locations
Alabama
The disrupted board systems provide statewide nurse licensing, verification and regulatory services across Alabama.
Montgomery, Alabama
Site anchor for the affected state board’s headquarters and technology operations in Montgomery. This relationship does not assert that the physical office itself closed; the documented disruption is to board services and systems.
Sources
We reported that the Sept. 1 cybersecurity incident disrupted statewide licensing and regulatory services, forced paper applications and verification workarounds, and delayed health care hiring while ABN restored systems in phases.
The current homepage says online 2026 single-state RN renewal is open and applies to APRNs practicing on single-state licenses. Separate application and monitoring guidance continues to describe workarounds.
The September 14 notice says ABN continues to recover from the cybersecurity event that disrupted services beginning September 1. It says paper applications and external primary-source reviews would begin September 14, initially prioritizing advanced-practice approvals, reinstatements and collaborations in progress during the outage, while some collaboration changes must wait until the licensing system is operational.
WBRC reports that Alabama Board of Nursing online services have been down since September 1, disrupting license renewal and initial licensing. The report describes paper application workflows, NCLEX-result handling, NURSYS verification workarounds, unavailable monitoring applications and the absence of a firm restoration date. It quotes and summarizes board officials and the board’s September 10 statement.
WBRC reported September 16 that the Alabama Board of Nursing’s entire online licensing system remained offline. Board officials said staff were protecting licensee data, securing systems, wiping compromised devices and processing applications by hand. Paper applications had expanded to new RN and LPN graduates and out-of-state nurses, temporary collection sites were planned around Alabama, and the Alabama State Nurses Association said the disruption was delaying hiring at hospitals, clinics and other healthcare facilities statewide. ABN gave no restoration timeline.
WBRC’s September 17 video page is titled “Cyberattack preventing nurses from license renewal.” The rendered page exposes the title and current-update metadata but no transcript, so it is used only as narrow evidence that renewal-related disruption was still being reported on September 17.
Nurse.org reported Sept. 19 that the Alabama Board of Nursing’s online licensing system remained offline and paper processing continued.
WAFF reported Sept. 21 that the Alabama Board of Nursing’s online licensing system remained unavailable, nurses could not apply or renew online and staff were collecting paper applications at schools.
Reports continued online licensing outage, completed paper new-license collection at Coastal Alabama, processing in Montgomery and an authorization-list verification workaround. RN renewals remained on hold without paper applications; Dec31 deadline still ahead. No firm board restoration date.
The board described suspicious August activity, malicious activity through Sept. 1, containment and progressive restoration of secure services, and confirmed that some data was collected and downloaded.
The board confirmed ransomware deployment and collection/download of some data. Sensitive personal or protected health information may have been exposed; the affected scope remains under investigation.
North Alabama Medical Center reported paper and fax licensing checks and additional administrative work, with unchanged nurse onboarding numbers, no significant hiring delays and unaffected patient care and safety.
The board reopened online single-state RN/APRN renewals Oct. 15 under a new licensing management system and payment vendor; recovery continued.
Single-state license renewals are available on the board’s new site; more applications will be added. The report reiterates August suspicious activity, malicious activity as of Sept. 1 and confirmed downloaded data.
Officials reported processing 3,000 paper licenses since Sept. 1. Renewal access had returned, while other applications remained under restoration. Huntsville Hospital reported minor processing delays without staffing or patient-care effects.
About 60,000 single-state nurses must renew by Dec. 1, with no deadline extension. RN renewals resumed in a new system; initial exam applications were expected next.
The Alabama Board of Nursing application page said all ABN online services were unavailable and directed new graduates to paper applications. It said staff would review applications in the order received and told people who applied before Sept. 1 not to submit another application.
Checked Oct. 19: online self-reports and quarterly employer, aftercare and counselor reports remain unavailable. Paper reports are required; October deadlines are extended to Oct. 31.
Continuing-education data uploads remain unavailable. An emergency rule temporarily waives documentation before renewal; providers must retain attendance rosters and may issue completion certificates. Provider applications are accepted by mail.
See something that needs correction?
Signed-in members can report an error, update, or missing source.