Coffee County
Coffee County, Georgia, cyberattack
Summary
Coffee County, Georgia, was disconnected from state election systems after a cyber incident identified in April 2024. Officials restored voter-registration access through isolated backup laptops and cellular connections while addressing the county network; the evidence does not establish compromise of statewide voting systems.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Website unavailable
A public-facing website was unavailable, disabled, or inaccessible.
-
Remote access disruption
VPN, remote desktop, telework, remote administration, or other remote-access capabilities were unavailable or restricted.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Coffee County, Georgia, acknowledged malicious activity in its IT infrastructure in April 2024. State officials disconnected the county from election-related systems as a precaution, and voter-registration access later resumed through isolated backup equipment.
Analyst assessment
The county’s April 26 statement, reproduced on a third-party site, says DHS/CISA notified officials of unusual cyber activity April 15. The county and its contracted IT provider declared an incident and examined evidence of unauthorized access. The statement reported no evidence of data exfiltration at that stage; it did not establish a final forensic outcome.
CNN reporting carried by WRAL says investigators believed ransomware was involved, citing unnamed sources familiar with the matter. That is a reported investigative assessment, rather than confirmed deployment, encryption or a ransom demand. No responsible actor is established.
Operational significance
CyberScoop’s reporting of the state notice identifies restrictions on GARViS voter-registration access, ePulse election management, election-night reporting and other state systems. A state spokesperson dated the protective disconnection to April 16. The report also observed portions of the county website unavailable April 25 and 26 and said officials described the records archiver as down for maintenance.
CNN reports that voter-registration access resumed after several days using backup laptops and cellular networks isolated from the affected county network. This is a workaround, rather than evidence that the county network or every election-system connection had been restored. The evidence does not establish compromise of GARViS, vote tabulation or other counties.
Confidence and uncertainty
Cyber involvement and loss of normal system access are well supported. Ransomware remains unconfirmed, and the county’s preliminary no-exfiltration finding does not establish that all data impacts were excluded. The separate January 2021 election-equipment breach and Fulton County’s 2024 attack are distinct incidents.
Analytic gaps
The initial intrusion date, entry method, affected-system count and final data findings remain unresolved. April 15 was a private notification, rather than the first verified public report. The specifically dated website interruption supports April 26 as the latest observed impact; the later update to a news article does not extend that timeline. Presumed-resolved status and an unknown operational end are retained because the backup access arrangement is not a positive all-systems recovery finding.
Organizations involved
Impacted locations
Coffee County, Georgia
Government service remit of Coffee County. The incident affected the functions described in the report; this area link does not assert that all services, residents or facilities were disrupted.
The affected county government has its commissioners’ office in Douglas, Coffee County. This physical-county relationship accompanies the existing Douglas office and county service-area relationships.
Douglas, Georgia
Coffee County’s April 26, 2024, Board of Commissioners statement gives its office as 101 South Peterson Avenue in Douglas. ACCG’s county directory independently lists the same physical address. Douglas anchors the affected county government; the reported website and state-system disconnections do not establish a citywide outage.
Sources
CNN reports a possible ransomware assessment and restored voter-registration access through isolated backup laptops and cellular networks; statewide system infiltration was not indicated.
County acknowledged malicious activity; state cut election-system access April 16, and parts of the county website were unavailable April 25 and 26.
County says DHS/CISA notified it April15 of unusual activity; it declared an incident, investigated unauthorized-access artifacts and initially found no evidence of exfiltration.
See something that needs correction?
Signed-in members can report an error, update, or missing source.