Georgia Department of Human Services’ SNAP call center
Georgia EBT call-center cyberattack disrupts account services
Summary
A July 28, 2025, cyberattack disrupted Georgia’s Conduent-operated EBT phone service and prompted protective card locks and replacements. The prolonged outage complicated some recipients’ account access before the state later confirmed restoration.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Customer or public access restricted
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
-
Third-party service disruption
The incident materially affected services delivered by or through a vendor, managed service provider, contractor, partner, or other third party.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Georgia’s Department of Human Services said a July 28, 2025, cyberattack disrupted the Conduent-operated interactive voice response system used by Georgia EBT cardholders. Initial reporting quoting DHS described automated bots and attempted improper account access. Conduent described an unusual increase in incoming calls and protective measures requested by the state.
The Aug. 4 DHS notice confirmed continuing disruption, announced a planned restart and said a subset of cards would be locked because of activity during the attack. The Aug. 5 notice then confirmed a brief morning restart followed by another state-directed shutdown. The first restart did not resolve the incident.
Operational significance
The unavailable phone channel normally supported card-status checks, balance inquiries and related account functions. DHS directed clients to the ConnectEBT app and website while telephone service was down. FOX 5’s Aug. 18 report documented the continuing outage.
WTOC’s Aug. 27 report quoted DHS and Conduent confirming the line remained offline pending security work. DHS said benefits had been issued on schedule, but some recipients reported trouble activating replacement cards or accessing funds. Replacement cards deactivated older cards, creating an additional access hurdle for affected households. The account-service disruption therefore had practical consequences beyond an unavailable telephone number; it does not establish a statewide failure to issue benefits or process all EBT purchases.
The Atlanta Journal-Constitution’s Oct. 29 reporting still found the line offline and described persistent activation difficulties. It reported that emails showed more than 45,000 replacement cards had been issued as a precaution. That is a reported replacement-card count, not a verified count of compromised accounts.
Confidence and uncertainty
Confidence is high in a cyber-related service disruption because DHS repeatedly acknowledged the attack and documented its operational response. The vendor’s narrower characterization and reported disagreement over the term cyberattack remain material qualifications. Bot activity and a call-volume spike do not establish a distributed denial-of-service technique, successful account intrusion, ransomware or a named attacker.
Reviewed evidence does not establish the number of successfully accessed accounts, incident-specific stolen benefits, encryption or an extortion demand. Card locking and replacement are protective actions, not proof that every affected account was compromised.
Analytic gaps
The final root-cause findings, precise access mechanism, successful fraud or data-access totals, and exact restoration day remain unestablished. The reported replacement-card count rests on the Journal-Constitution’s account of obtained emails; the underlying collection has not been independently verified.
Our Aug. 1 coverage documented the initial service disruption. Conduent’s separate January 2025 breach, general EBT fraud statistics and the later federal-shutdown funding dispute are not incorporated into this event. Related-state reporting does not establish common attribution.
The current official restoration notice affirmatively says the IVR is back online with additional monitoring requested by DHS. That supports resolved status. The notice is undated, so the exact end remains unset; Oct. 29, 2025, is the latest dated outage observation reviewed.
Organizations involved
Impacted locations
Atlanta, Georgia
Preserves Atlanta as the existing affected state service’s administrative site anchor. This does not establish an outage in the DHS office building or locate Conduent equipment.
Georgia
The affected IVR served Georgia EBT cardholders statewide. This describes the service’s jurisdiction, not loss of all benefits, payment processing or every cardholder’s access.
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.