Pulaski County Circuit and County Clerk’s Office cyber incident

Analyst assessment

A cyber incident disrupted computer systems at Pulaski County Circuit and County Clerk’s Office beginning Jan. 16, 2025. KATV reported a security incident Feb. 6 after reviewing an emergency incident-response contract. The clerk had not yet confirmed a hack in that report. The office expressly acknowledged the cybersecurity incident April 8, after earlier official notices described technical difficulties. The office’s acknowledgment and documented loss of public services support inclusion as a confirmed disruptive cyber incident with high confidence. The reviewed evidence does not establish ransomware, a responsible actor or a specific entry route.

Operational significance

The office reported Jan. 21 that it could not issue marriage licenses or process voter registrations and had limited ability to record liens, deeds and other documents. That notice said accounting and court-clerk departments were operating normally. Residents could contact the office by phone or in person. A Jan. 27 notice directed marriage-license applicants to clerks in Faulkner, Lonoke and Saline counties while computer systems remained down.

Recovery varied by service. A Jan. 31 report quoting the clerk’s statement said voter registration applications could again be processed, but marriage licenses remained unavailable and real estate recording remained limited. Accounting, court-clerk and central receiving departments were operating at a reduced pace by that date. These dated notices establish partial disruption rather than closure of every clerk function or all county government operations.

KATV’s Feb. 6 account reported that marriage licensing had resumed by the interview and most office functions were working, although some ran more slowly. This documents further partial recovery without establishing the exact date every service returned.

Confidence and uncertainty

The original April 8 release said the office had recovered and attributed restoration assistance to Heartland Business Systems. The clerk said a large portion of servers had been restored during the first seven days and that no personal data was compromised. KATV’s contemporaneous report also quoted the clerk’s findings. Partial server restoration does not establish that every service returned within a week; the January notices document continuing restrictions.

The Jan. 17 emergency response contract, publicly reported in February, authorized containment and incident triage, including investigation of attacker entry and affected machines. Its optional dark-web assessment describes proposed work, rather than a finding of stolen data. The $275 hourly rate and two-hour minimum do not establish final spending. The contract’s signing date does not establish when it became public.

The office introduced anti-phishing measures, staff training and government-domain email addresses after the incident. These measures do not establish that phishing caused it. The no-data-compromise finding is attributed to the clerk; the reviewed evidence contains no public forensic report independently establishing the full confidentiality, integrity or availability effects on data. No matching stable ransomware claim was found in searches of the office’s canonical name, current and legacy domains and supported public names.

Analytic gaps

The exact intrusion start, technical mechanism, compromised systems, costs and complete restoration date remain unknown. The clerk’s April 8 recovery announcement supports resolved operational status, but the end date remains unset because the statement does not identify when the final affected service returned. The Feb. 6 reporting documents lingering slowdowns after several functions resumed; it does not establish the exact end of disruption. KARK’s April report also describes systems remaining offline into February without identifying a specific final restoration date. Our April 10 Ghost article is the intake driver. Its speculation about deeper access is not treated as a forensic finding.