Ogeechee Judicial Circuit DA’s Office cyberattack

Analyst assessment

A cyberattack disrupted the Ogeechee Judicial Circuit District Attorney’s Office in Georgia on June 11, 2025, prompting the temporary closure of its physical offices. The office said its technology contractor detected the intrusion around 6 a.m. and intervened while it was occurring. Its initial statement, republished by Grice Connect, announced a tentative five-day closure while systems were assessed and recovered.

Our reporting documented the office’s initial account and its four-county remit: Bulloch, Effingham, Jenkins and Screven counties. The affected organization was the circuit prosecutor’s office. The evidence does not establish separate intrusions into each county government or a shutdown of all courts within the circuit.

Operational significance

The disruption affected staff access to email and normal office work, as well as their ability to appear in court. The Record reported phone and internet outages during the response. The office notified the Georgia Bureau of Investigation’s Cyber Crimes Division and coordinated with the chief judge, clerks, public defenders and other court partners to maintain essential functions.

The closure did not end all prosecutorial work. In its June 17 reopening statement, the office said employees had continued court and other critical duties despite limited system access. The incident therefore combined closed offices and impaired communications with efforts to sustain judicial work.

Both office locations were open and fully operational as of the morning of June 17, according to that statement. The office said every computer had been inspected and credited Georgia Technologies with interrupting the attack. The actual reopening announcement provides stronger evidence of the recovery date than the initial tentative five-day estimate.

Confidence and uncertainty

Confidence is high that a cyberattack caused operational disruption because the office publicly described the intrusion, closure and recovery. The contemporaneous statement’s Wednesday-morning chronology supports June 11 as the documented onset. The Record’s later account refers to Tuesday morning; that discrepancy remains unresolved, and the office’s original chronology is given greater weight.

The office said the attackers had not accessed active files and that complete recovery was possible. Those statements describe its findings and expectations at the time. They do not establish that every category of data was untouched or that every file had already been restored. The available reporting does not substantiate encryption, data theft, a ransom demand or a payment.

Analytic gaps

The attacker, initial access method, precise technical scope and final forensic findings remain unverified. No corroborated ransomware claim was identified in the reviewed material. The June 17 statement establishes the return of office operations while an investigation continued; it does not supply a complete technical account of the intrusion.