Alabama State Department of Education breached in a halted ransomware attack

The Alabama State Department of Education disclosed on 3 July 2024 that its computer systems had been attacked on 17 June. Department IT staff interrupted the intrusion while it was under way, stopping the attackers before they could finish encrypting servers and extort a ransom for the data.

State Superintendent Eric Mackey said that some data and services were nonetheless breached and disrupted. Officials said personally identifiable information belonging to students and to education employees may have been taken, potentially including names, addresses and Social Security numbers. They said financial details such as credit card and bank routing numbers were not at risk because the state does not hold that data on its servers.

The department restored all affected data from clean backups and said it would not negotiate with what it described as foreign actors and extortionists. It hired an outside contractor to review state servers and determine exactly what had been taken, and it worked with state and federal law enforcement, the Alabama Attorney General and the state Office of Information Technology on the investigation.

Mackey advised parents and education staff to monitor their credit and to assume some of their data may have been compromised. The department set up a dedicated page and email address for questions and said individuals would be notified once the specific compromised records were identified. Officials declined to describe the security changes made afterwards, citing the ongoing criminal investigation.