Skip to content
DysruptionHub
Sign in Subscribe

Alabama state government cyber incident

Summary

State of Alabama logo

Alabama detected unauthorized activity on state systems on May 9, 2025, and confirmed that some employee credentials were compromised. Officials reported no major service disruption and later warned of intermittent remediation-related interruptions; a specific completed public-service outage remains unverified.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.

Primary victim organization

Impacted location

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
Unresolved

Attack mechanisms

Data impacts

  • Unauthorized data access

    An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.

Operational impacts

  • Unknown operational impact

    Available evidence does not establish whether the incident caused material operational or service disruption.

Extortion indicators

  • Unknown extortion indicators

    The incident may involve extortion, but available evidence does not establish which extortion indicators were present.

Incident narrative

Alabama’s Office of Information Technology detected a cyber incident on May 9, 2025. The governor’s office confirmed compromised usernames and passwords for some state employees.

Analyst assessment

The official statements establish unauthorized activity, but the reviewed record does not establish a specific completed public-service outage. The initial warning that websites, email or telephone communications might be interrupted should not be presented as proof that every channel failed.

Operational significance

A May 14 update said no major disruptions had been traced to the event and directed executive-branch agencies to reset employee passwords. These response measures do not identify an interrupted public transaction or unavailable essential service.

Response and status

The May 20 final update said the threat had been contained and core operations were stable. Officials anticipated intermittent website or service disruption during subsequent remediation. Containment is not an exact service-restoration date; historical status is presumed resolved.

Confidence and uncertainty

Confidence in cyber involvement is high. OIT did not identify an attacker and reported no evidence of further unauthorized activity. The reviewed statements do not establish ransomware, encryption or citizen-data exfiltration.

Analytic gaps

The affected agencies and applications, duration and actual occurrence of service interruptions, initial access method and complete restoration date remain unresolved. The incident remains a draft pending concrete operational-impact evidence for registry inclusion.

Organizations involved

Impacted location

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.