Morgan County 911’s May 2025 cyberattack disrupted administrative systems and partner connections while critical emergency services remained operational. Precautionary isolation interrupted the sheriff’s inmate-roster feed, which returned May 20; the center’s director later confirmed Qilin’s involvement while disputing the group’s claims.
Unauthorized access to systems, accounts, networks, or data.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Internal or external network connectivity was unavailable or materially impaired.
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
A specific application or software platform became unavailable or unusable.
VPN, remote desktop, telework, remote administration, or other remote-access capabilities were unavailable or restricted.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Police, fire, emergency medical, corrections, emergency management, or other public-safety operations were materially affected.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
The incident materially affected services delivered by or through a vendor, managed service provider, contractor, partner, or other third party.
The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.
Morgan County 911’s May 2025 cyberattack disrupted administrative systems and connections used by partner agencies in Alabama. WAFF’s May 13 report documented the center’s acknowledgment of a cyber issue, establishing public disclosure before the May 14 date used in some later accounts. We assess the attack and associated administrative disruption with high confidence because agency statements and named officials describe the compromise and its operational effects.
The emergency communications district and the Morgan County Sheriff’s Office had distinct roles. The attack affected the 911 center’s administrative environment; the sheriff’s office lost a shared data connection when county technology staff disconnected the networks as a precaution. That downstream interruption does not establish a separate intrusion into the sheriff’s network.
The isolation limited remote agency computers’ visibility into dispatch information and interrupted the sheriff’s public inmate-roster service. Director Jeanie Pharis’ account, reported by The Decatur Daily and syndicated by Government Technology, said call history, the central computer-aided dispatch system and radio communications remained functional. Administrative rebuilding and accelerated security work continued while the center maintained its critical services.
The sheriff’s May 20 message confirmed that the data connection had returned and the roster was again updating every 15 minutes. The office’s public post also announced restoration and supplied arrest and release information for May 14–19. These statements establish recovery of the roster connection, rather than an exact completion date for every affected 911 administrative system.
Qilin’s listing for the center’s domain was recorded in July. Comparitech’s subsequent report quotes Pharis confirming Qilin’s involvement while disputing the group’s representations. The attributed victim statement provides stronger support for responsibility than the listing alone. Pharis characterized the intrusion as closer to brute force than phishing; the reviewed record does not independently establish the compromised account, exposed service or precise entry method.
Comparitech reported that the group posted apparent financial documents as proof. Their authenticity and the extent of any data acquisition remain unverified in the reviewed material. The director’s confirmation of Qilin does not validate every leak-site allegation or establish file encryption. No verified affected-person count, ransom amount or payment outcome was found.
The record leaves the exact attack start, detailed technical sequence and full administrative restoration date unresolved. The latest dated operational account reviewed was published May 19 and quoted the director’s Friday remarks; May 16 is used as the last directly attributable observation of administrative rebuilding. The later claim and interview do not establish renewed operational disruption. The incident is presumed resolved, with the specific May 20 roster restoration retained separately from an unsupported all-systems closure date.
Qilin listed the emergency district’s exact domain. The director later confirmed Qilin to Comparitech while disputing the group’s claims. Discovery date is not publication; data provenance, encryption, ransom and payment remain unresolved.
Decatur anchors the 911 center and sheriff’s offices. This relationship does not assert a citywide outage.
Morgan County represents the public-safety agencies’ geographic remit. Administrative and data-connection effects do not establish loss of emergency service throughout the county.
We reported administrative disruption and a precautionary network disconnect affecting the sheriff’s inmate roster and remote dispatch visibility while core 911 services remained operational.
The center acknowledged a cyber issue affecting administrative systems. Officials said 911, communication with responders and critical services were unaffected.
Director Jeanie Pharis described administrative rebuilding and restricted partner remote connections while central dispatch functions remained operational. County IT isolated the sheriff’s network, interrupting roster access.
Sheriff Ron Puckett confirmed that the data connection isolated after the 911 center’s cyberattack had been restored May 20 and that the roster was updating every 15 minutes.
The sheriff’s office announced the inmate roster was working again after the previous week’s cyberattack at Morgan County 911 and linked arrest/release updates forMay 14–19.
Director Jeanie Pharis confirmed Qilin’s involvement to Comparitech, disputed the group’s claims and said critical 911 operations were never hindered. The report described apparent financial-document samples; data scope and payment were unconfirmed.
The monitored Qilin listing names morgan 911.org, matching the emergency communications district’s official domain.
Signed-in members can report an error, update, or missing source.
