Arizona Secretary of State
Arizona Secretary of State candidate portal cyberattack
Summary
A June 23, 2025 intrusion changed images in Arizona candidate profiles and prompted a temporary portal shutdown. Candidates used alternate filing arrangements. Officials later reported containment and restoration; voter registration, protected-address records and tabulation systems were separate and unaffected.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
-
Malware
Malicious software other than ransomware used to compromise or disrupt systems.
-
Website defacement
Unauthorized modification or replacement of website content.
Data impacts
-
Data alteration or manipulation
Data was intentionally changed, falsified, manipulated, or otherwise modified without authorization.
Operational impacts
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
The Arizona Secretary of State’s candidate portal was compromised in June 2025, prompting a temporary shutdown and alternate arrangements for candidate filings. Our July 1 report documented the initial disclosure. The office’s later retrospective timeline dates detection and shutdown to June 23 and restoration of servers from pre-attack data to June 24; that server milestone does not establish when public portal access resumed.
Operational significance
The July 1 official notice says staff restricted access for a security review and worked directly with candidates needing to submit documents. This was a loss of the normal online service with continuity through staff assistance. The evidence does not establish missed legal deadlines or a count of affected candidates.
Votebeat’s July 17 report, quoting the office’s spokesperson, describes roughly a week offline and confirms that the portal had returned. Candidate profile images feeding a public election website had been changed. A July 19 report from KJZZ states that the issue was resolved and distinguishes the affected website from election tabulation.
Confidence and uncertainty
Confidence is high in the cyberattack and service consequences because the office acknowledged both. CyberScoop’s interview with the chief information security officer describes malicious code concealed in an uploaded image and changed candidate photos. These findings support unauthorized access, malware and website defacement, without establishing ransomware or a named perpetrator.
The office associated the activity with Iranian interests, but its technical official said attribution was not definitive. Political imagery and timing are context, rather than proof of state direction. No specific actor organization is identified in this record.
Early reporting left possible private candidate-data access under investigation. The office’s Aug. 12 update said no sensitive information had been accessed and that voter registration and the protected-address program were unaffected. That reassurance is consistent with a limited portal compromise; it does not erase the documented alteration of public candidate images.
Analytic gaps
The exact return-to-service time, number of changed profiles and affected users, detailed forensic findings and independently verified attribution remain unavailable. A July 31 interview with Secretary Adrian Fontes described modifications to block recurrence, but does not provide an exact restoration date.
The operational disruption is resolved based on the July reporting. No precise end date is assigned. The June 24 server recovery and the approximately weeklong portal outage are retained as distinct milestones; later E-Qual malfunctions are separate events and are not added to this attack’s duration.
Organizations involved
Impacted locations
Arizona
Arizona is the office jurisdiction. The documented disruption affected the candidate portal rather than all election services or every location.
Phoenix, Arizona
Phoenix administrative base of the affected office.
Sources
Our report describes portal unavailability and alternate filing arrangements after detected malicious activity.
Office acknowledges malicious activity, portal shutdown for review and staff-assisted candidate filings.
Spokesperson confirms profile-image changes, about a week offline, alternate submissions and return of the portal.
Report states the issue was resolved and records qualified attribution and separation from vote tabulation.
CISO describes the June23 discovery, changed images, image-upload payload and containment; definitive attribution unavailable.
Secretary describes malicious software, changed pages and portal modifications to prevent recurrence.
Office says incident contained, sensitive data not accessed and separate registration/protected-address systems unaffected.
Retrospective June2025 chronology records June23 portal shutdown and June24 restoration of servers to pre-attack data.
See something that needs correction?
Signed-in members can report an error, update, or missing source.