Ransomware disrupted the Pennsylvania Office of Attorney General’s communications and litigation-data access after detection in August 2025. Public communications returned, but court proceedings were delayed, and no complete recovery date was established.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Internal or external network connectivity was unavailable or materially impaired.
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
A public-facing website was unavailable, disabled, or inaccessible.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Services continued but with longer processing, response, delivery, or completion times.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
The extortion activity involved unauthorized encryption of systems or data, with restoration or decryption conditioned on payment.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.
An authoritative source stated that no ransom or extortion payment was made.
A ransomware attack disrupted the Pennsylvania Office of Attorney General’s communications and access to litigation data in August 2025. The office’s later data-incident notice dates detection to Aug. 9, before its Aug. 11 public acknowledgment. Detection is the earliest supported incident activity, not a verified first day of intrusion.
We reported Aug. 11 that the office’s network, website, email and landline systems were offline. Contemporaneous reporting quoted the attorney general’s official cyber-incident announcement while the cause remained under investigation. The Aug. 29 official update later confirmed an outsider encrypted files to compel payment. The office said it had made no payment.
Restoration of public communications did not mean complete recovery. By Aug. 29, the main phone line and website were online and most staff had email, but employees continued using alternate methods and full restoration was ongoing. The office said its personnel continued court appearances and investigative work despite those limitations.
The Middle District federal court’s Aug. 21 order documented disabled access to data needed to contact witnesses, answer pleadings, conduct discovery and prepare for court appearances. Its civil stay and subsequent relief in other courts were downstream effects of the office’s outage; they do not establish that court networks themselves were compromised.
A Sept. 17 Eastern District order still described significant disruption. Philadelphia’s extension order provided relief through Oct. 14 unless litigation access returned earlier. Reporting on Sept. 22 described continuing inability to proceed with litigation despite recovered communications. Scheduled stay expirations are administrative endpoints, not measured recovery dates.
Ransomware confidence is confirmed because the victim explicitly described encryption for payment. Its Sept. 17 update reiterated that no payment had been made and said a few individuals had been notified that information might have been involved.
Comparitech reported that INC Ransom claimed the attack Sept. 20 and asserted it stole 5.7 TB, offering purported sample images. The office had not verified that attribution. Named-actor confidence is low; the claim’s volume and further boast about FBI-network access remain unverified.
The Nov. 14 issuer notice says certain files may have been accessed without authorization and may have contained names, Social Security numbers or medical information. It reported no evidence of misuse. A later news report described stolen files more definitively. The accessible victim notice supports possible personal-information access, not an independently verified theft volume or publication finding.
The initial intrusion date, complete access window, precise malware, confirmed entry route, final affected population, response cost and all-systems restoration day remain unestablished. Reports of exposed Citrix NetScaler devices provide an investigative lead, not proof that a particular vulnerability caused this intrusion. The unrelated 2024 Pennsylvania courts denial-of-service incident is excluded.
Operations are presumed resolved based on elapsed time since the Sept. 22, 2025 observation of continuing litigation-access impairment. Partial restoration is documented, but no affirmative complete-recovery notice was found. The exact end remains unset. Later breach notifications and data-review work do not, by themselves, extend the operational clock.
INC Ransom claimed the Pennsylvania Office of Attorney General attack. Comparitech reports a Sept. 20, 2025 claim; MCP discovered it Sept. 21 at 00:46:34.134629 UTC. Original post timestamp was not independently verified. Claimed 5.7 TB, sample authenticity and FBI-network-access boast remain unverified. The victim confirms encryption to force payment and says it paid nothing; it has not verified INC attribution. Existing claim repaired without duplication.
Harrisburg is the headquarters and administrative site anchor for the affected statewide office. Retains the existing municipality without creating a facility location or implying city-government compromise.
Pennsylvania supplies statewide governmental service context for the Attorney General’s regional offices and litigation responsibilities. It does not mean every state agency or resident was technically compromised.
The office confirms file encryption to force payment, says it paid nothing, and describes communications restored for most staff while alternate work methods and full recovery continue.
The office dates initial detection to Aug.9,2025 and says certain files may have been accessed without authorization, involving names, Social Security numbers and/or medical information.
Signed-in members can report an error, update, or missing source.
