Virginia attorney general’s office cyberattack

Analyst assessment

A cyberattack disrupted the Virginia attorney general’s office on Feb. 12, 2025. Contemporaneous Associated Press reporting described a staff message identifying widespread loss of access to document management, email, collaboration, shared files, remote access and internet connectivity. The office’s work included representing Virginia agencies and handling matters before the state’s appellate courts.

The confirmed cyber incident should be distinguished from later attribution claims. In March, Cloak listed the office as an alleged victim. That listing does not independently establish who caused the February outage, whether ransomware encrypted systems or whether the actor’s claimed files were authentic.

Operational significance

The outage affected attorneys’ ability to prepare, exchange and submit legal documents. AP reported that the Supreme Court of Virginia and Court of Appeals offered paper filing alternatives. StateScoop’s Feb. 13 report also described shutdowns and interrupted email, VPN, internet and website access. It reported that the office did not respond to its request for comment and that the Virginia Information Technologies Agency declined to comment because of the investigation.

A later firsthand court presentation, attributed to Court of Appeals Chief Deputy Clerk Megan Scanlon, gives a more detailed operational timeline. The clerk’s office stopped processing electronic filings from the attorney general on Feb. 12. On Feb. 13, it arranged incoming paper filings and outgoing paper orders, granted automatic two-week filing extensions and rescheduled oral arguments as needed. A Feb. 14 judicial-system message described password resets for attorney general staff accounts so access could be recovered when agency systems returned. These measures document disrupted legal workflows and precautions; they do not prove the courts’ systems were breached.

SANS NewsBites’ Feb. 18 issue included Lee Neely’s observation that the agency website appeared back online. This supports partial recovery of a public-facing service, rather than restoration of every internal system. The reviewed record does not establish an exact date for full restoration.

Confidence and uncertainty

Confidence is high that the attack caused material disruption because the reported agency staff message and the court clerk’s account describe unavailable tools and concrete workarounds. The exact intrusion start remains unknown; Feb. 12 is the documented disruption date.

SecurityWeek reported March 21 that Cloak added the office to its leak site March 20 and offered allegedly stolen data for download. Security Affairs’ March 24 report described an alleged 134-gigabyte theft, initial screenshots and a purported full archive. These are reported actor claims, without independent verification of the volume, authenticity, affected people or actor responsibility. No reviewed evidence establishes a ransom payment or a case-specific encryption method.

Analytic gaps

The precise full-restoration date, forensic access findings, incident-specific costs and verified privacy impact remain unresolved. Presumed resolved status reflects the historical incident and documented partial recovery, with no exact end date assigned. Initial public reporting relied on an internal agency message; a separate direct public agency acknowledgment was not located in the reviewed sources.