Intoxalock cyberattack and nationwide service outage

Analyst assessment

DysruptionHub assesses with high confidence that Intoxalock experienced a confirmed cyberattack that materially disrupted its nationwide service network beginning March 14, 2026. Intoxalock’s official status chronology said it was investigating a cybersecurity event affecting its ability to service customers and had paused systems as a precaution. A company spokesperson later confirmed the cyberattack to TechCrunch.

The attack affected Intoxalock’s service infrastructure rather than disabling every installed ignition-interlock device. Intoxalock said devices remained operational, but systems needed for installation, calibration, removal, account access and service-center support were unavailable or restricted. Drivers whose vehicles required calibration or related service could face delayed starts or lockouts even though the device itself continued performing its alcohol-testing function.

Operational significance

Intoxalock operates through a service-center network spanning 46 states. The system pause blocked new installations and disrupted calibrations, removals, account access and service-center transactions. Drivers reported vehicles that would not start, towing needs, lost work and concern about court or licensing compliance. Intoxalock offered reimbursement for qualifying towing costs and developed a 10-day device-extension workaround where state authorities permitted it. Eligibility varied by state and during the response.

Independent reporting directly documents blocked work at two downstream service businesses. WCVB reported that Juniors Automotive Sales and Service Inc. in Middleborough, Massachusetts, had vehicles sitting at the shop because technicians could not complete Intoxalock recalibrations. WMUR reported that blocked Intoxalock service-center computers prevented Guillermo Auto Repair LLC in Manchester, New Hampshire, from doing affected work and hurt the business financially.

Evidence for Baldwin Electronics is narrower. Cybernews reported that the Odessa, Texas, service center publicly asked Intoxalock what it should tell customers about towing and lockout expenses. That supports a downstream relationship and an Odessa connection, but it does not establish that Baldwin’s own systems were unavailable or that its work stopped. The incident’s Odessa impacted-location confidence is therefore medium. None of the three businesses is known to have been a direct cyber victim.

Government-program effects

State agencies had to address compliance consequences because Intoxalock devices are used in court- and licensing-mandated programs. This does not mean agency networks or public services were disrupted. Massachusetts’ Registry of Motor Vehicles authorized a 10-day extension window for eligible customers after an initial delay. The Oklahoma Board of Tests for Alcohol and Drug Influence said it did not operate or control the vendor’s devices or systems, instructed participants to document contact and service attempts, and said compliance would be evaluated case by case under applicable law. No reviewed agency notice reported that an agency system was compromised or unavailable.

Disclosure posture

Intoxalock first used concrete cyber-specific wording March 15, the day after the company says the event began. Because the affected organization publicly characterized the event before any identified external actor claim, the disclosure sequence supports OC. The documented nationwide interruption to customer and service-center functions supports OD.

The company’s updates described precautionary isolation, customer accommodations and staged recovery. They did not identify an attack vector, responsible actor or malware family. TechCrunch reported that Intoxalock would not say whether ransomware or a data breach occurred or whether it received ransom communications.

Current status

Intoxalock said at 5:30 p.m. EDT March 22 that installations, calibrations and service-center support had resumed and service centers were fully operational. A later Tennessee transition deadline addressed compliance after restoration; it does not establish continuing system unavailability. The incident is therefore classified as resolved, with March 22 retained as the last documented operational-impact date. Recovery does not establish when malicious activity ended, so the attack’s technical end date remains unknown.

Confidence and uncertainty

Confidence is high that a cyberattack caused the service disruption because Intoxalock used cyber-specific wording and its spokesperson confirmed the attack. Confidence is also high that the outage affected drivers and service businesses across multiple states, though public evidence does not establish that all customers or all service centers were affected at once. Connecticut Public reported an Intoxalock estimate of about 6,000 Connecticut customers, with 7% to 10% needing calibration during the disruption.

Ransomware and threat-actor attribution remain unresolved. No stable ransomware or extortion victim claim was identified. A proposed class action reported by KCCI alleges that attackers stole data and that customers suffered vehicle, towing, employment and financial effects. Those assertions remain allegations and do not independently establish data acquisition or the full scope of impact. No public forensic report or breach notice reviewed for this assessment confirms what information, if any, was accessed or taken.

Analytic gaps

The public record does not establish the initial access vector, compromised account or host, exploited vulnerability, attacker dwell time, persistence, lateral movement, command-and-control infrastructure, encryption activity or exact systems isolated. It also does not identify a ransomware family, responsible actor, ransom demand, negotiation, payment or public data release.

The record does not establish whether data was accessed, acquired, altered, encrypted or deleted; which records or people may have been affected; or whether notification obligations were triggered. The full number of drivers, service centers and transactions affected nationwide is also unknown.