Skip to content

Cyberattack takes Ohio Auditor of State’s web services offline

Audit clients get a payment grace period while email and regular audit work continue, the office says.

ntrance to 65 East State Street, with tall columns, glass doors and a tenant directory listing Ohio Auditor of State Keith Faber.
The office building at 65 E. State St. in Columbus houses the Ohio Auditor of State’s office. (The Pacifico Group)

A cyberattack has shut down the Ohio Auditor of State’s website and online accounts, leaving government audit clients facing possible payment difficulties.

Auditor Keith Faber disclosed the Sunday attack in a statement Tuesday, Cleveland.com reported. The website remained unavailable when we checked it Tuesday afternoon.

The Columbus-based office audits more than 5,900 state and local government entities. Email remained operational, and Faber said auditors would continue their regular work.

Audit clients having trouble making online payments will receive a grace period until further notice, the office said. Payments use a separate state portal, and clients’ financial information is not stored on the affected web server, Faber said.

Faber said monitoring systems detected the threat and officials quarantined it before taking the web server and online accounts offline. Internal and outside experts are investigating, and state and federal law enforcement have been notified.

Faber said the attack did not involve ransomware and that backups prevented data loss. Officials had no evidence that Ohioans’ personal financial information was at risk, he said, and government clients’ financial information appeared uncompromised.

Chip in once
If this reporting helped you, a one-time tip helps cover hosting, tools and future investigations.

Tip us

Support us monthly
A small monthly pledge keeps independent coverage and our reader tools online for everyone.

Become a Supporter

“We typically don’t work directly with individual citizens, so we don’t expect Ohioans to have to take any protective measures based on this incident,” Faber said in the statement, according to Cleveland.com.

Faber said overseas cybercriminals carried out the attack and that foreign state actors may have been involved. The office has not identified a group or disclosed the attack method.

The office plans a temporary website to communicate with the public and government agencies while restoration work continues. It has not announced when normal web services will return.

DysruptionHub Staff

DysruptionHub Staff

DysruptionHub Staff is the publication’s organizational byline for reports based on public statements, government records, regulatory filings and other available material when no single journalist contributed substantial original reporting.

All articles

More in Government

See all

More from DysruptionHub Staff

See all