Federal Public Defender for the District of Arizona ransomware attack

Analyst assessment

A ransomware attack encrypted the Federal Public Defender for the District of Arizona’s district-wide network late March 29, 2025. The office’s June 6 court filing describes losing access to network files and being held for ransom. Employees were told not to use their work computers, and personal devices were also prohibited during recovery. This direct account supports high confidence in ransomware and material operational disruption.

The affected organization is a federal defender office within the Ninth Circuit. It represents clients in federal criminal matters and capital proceedings, including cases arising from state convictions. Its participation in a Utah case does not place the Arizona office in the Tenth Circuit or establish a compromise of Utah’s court network.

Operational significance

The original April 8 report describes loss of access to a nearly completed reply brief in Ralph Menzies’ competency proceedings. The court allowed the reply by April 18 and moved arguments to May 7. These are different deadlines. An Arizona’s Family report also documents an Arizona federal trial postponed from April 22 to Sept. 15 after counsel reported unavailable file-storage and backup systems.

The June filing says the rebuilt network and widespread computer redistribution became available during the week of May 12. That restored a working environment, while the original network files remained encrypted. Staff had to obtain records from courts and other sources, scan paper material and reconstruct work product. Network restoration therefore does not establish recovery of the information needed for normal case preparation.

A Dec. 29 filing in another capital case says the office’s work product remained unrecoverable and that the client’s file had not yet been reconstructed. The state’s reply acknowledged difficulties but disputed whether they justified delaying the requested schedule. The Jan. 16, 2026, scheduling order considered the parties’ positions, the victims’ position and the court’s calendar. It should not be presented as a finding that the cyberattack alone determined the schedule.

Confidence and uncertainty

Later Bloomberg reporting quotes the office’s administrative officer describing corruption of systems and backups, and reports theft as well as encryption of client and internal records. The office was still assessing the breach and restoring data. Those accounts support data compromise, but do not establish a complete affected-person count, a precise quantity of stolen data or public release of the records.

No matching stable claim was found in six searches of the office’s canonical name, domain and supported public names. The Rhysida attribution in the same Bloomberg article concerns New Mexico’s separate state defender office. It is not evidence that Rhysida attacked the Arizona federal defender. The Arizona attacker, entry route, demand amount and payment outcome remain unknown.

Analytic gaps

The exact intrusion start before the reported compromise, full scope of compromised information, response costs and final recovery date remain unresolved. The March 30 discovery reported by Australian Associated Press is distinct from the late March 29 compromise. Earlier court disclosures are reported, but the earliest original public posting date has not been independently established.

December 29 is the latest precisely dated direct observation of continuing file-reconstruction effects found in this review. Later litigation does not by itself establish a continuing outage. With no newer operational observation for more than 30 days and no authoritative full-recovery announcement, operational status is presumed resolved; the exact end date remains unset. This status does not mean that encrypted records were recovered or that the earlier effects were minor.