Georgia Secretary of State
Georgia absentee-ballot portal DDoS causes brief slowdown
Summary
A distributed denial-of-service attack briefly slowed Georgia’s absentee-ballot request system on Oct. 14, 2024. Officials said the portal continued working and recovered that evening.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing. -
Incident end:
?
Confirmed or defensibly assessed end of material operational disruption or incident activity.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Distributed denial of service (DDoS)
Intentional disruption of services through overwhelming network traffic.
Data impacts
-
No known data impact
Available evidence indicates that the incident did not materially affect the confidentiality, integrity, or availability of data.
Operational impacts
-
Degraded service
Services remained available but with reduced performance, reliability, functionality, capacity, or responsiveness.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
Extortion indicators
-
No known extortion indicator
Available evidence indicates that no extortion demand, threat, communication, or related pressure tactic was identified.
Incident narrative
Analyst assessment
Georgia’s secretary of state’s office confirmed that a distributed denial-of-service attack briefly slowed the system used to request absentee ballots on Oct. 14, 2024. Chief operating officer Gabriel Sterling told CNN that the systems continued working and voters retained the ability to request ballots.
Operational significance
The documented effect was a processing slowdown on the absentee-ballot portal. It does not establish a portal crash, lost ballots, altered votes or an interruption to casting or counting votes.
According to FOX 5 Atlanta’s account of Sterling’s explanation, the office detected unusual activity around 5:16 p.m. Eastern time. More than 420,000 IP addresses attempted access at the peak. The office and its security partner deployed checks requiring users to demonstrate they were human, after which the traffic fell.
Normal traffic levels returned around 5:40 p.m., the station reported. Officials continued monitoring and determined by 10 p.m. that the attack had subsided. These are separate milestones: operational performance recovered before monitoring of the attack ended.
Confidence and uncertainty
Confidence is high in the cyberattack and brief degradation because the office acknowledged both in original reporting. Sterling also publicly credited the cybersecurity team and its partners. The Associated Press reported his statement that no data was compromised.
Sterling suggested a foreign source, but the reviewed reporting did not establish a responsible country or group. IP addresses in multiple countries do not independently establish who directed the attack. Cloudflare’s defensive role does not make the company a separate intrusion victim.
Analytic gaps
The available account does not quantify affected requests or measured response times. The incident is resolved on the reported same-day recovery, with the latest reviewed operational account published the following week. No ransomware or extortion demand is established.
Organizations involved
Impacted locations
Atlanta, Georgia
Retain Atlanta as the affected state office’s supported operating place and normalize the legacy role. Original agency and City of Atlanta records establish the actual State Capitol office in Atlanta/Fulton County. The incident affected an online absentee-ballot request service, not Atlanta city government, every office in Atlanta or a known physical server site.
Georgia
Georgia is the service jurisdiction of the affected statewide absentee-ballot request portal. Pair this remit with the existing agency relationship. This does not establish a statewide shutdown, an outage at every county office or inability to cast/count votes; original reporting describes only brief processing degradation.
Sources
The Ghost driver describes a temporary slowdown during an attack on the absentee-ballot request site.
Sterling described detection around5:16p.m., recovery of normal traffic around5:40p.m. and continued monitoring until the attack subsided by10p.m. onOct14.
Sterling credited the cybersecurity team and its partners while sharing the CNN report about the Georgia attack.
Sterling directly acknowledged a cyberattack and a brief slowdown while saying the system continued working and ballot requests remained possible.
The office acknowledged preventing a crash of the absentee-ballot website, and the report links Sterling’s original public response.
Sterling said the portal did not crash and no data was compromised.
See something that needs correction?
Signed-in members can report an error, update, or missing source.