Coffee County, Georgia cut its link to the state voter roll after a cyberattack

Coffee County, a rural county in south Georgia, was notified by the Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency on April 15, 2024 that suspicious cyber activity had been detected on its network. The county board of commissioners declared a cyber incident and opened an investigation with federal authorities.

State election officials cut the county off from GARViS, the statewide voter registration system, and other state systems for multiple days. Secretary of State spokesman Mike Hassinger said the office "took immediate action on April 16th, before Coffee County would acknowledge the issue, and cut them off from all of our systems immediately." The disconnection drew attention because early voting for Georgia's May primary began on April 29, and election staff had to fall back on paper voter record files and manual check-in lists.

County officials told WALB the county may have been the victim of a ransomware attack. CNN, cited by Infosecurity Magazine, reported the incident was likely ransomware. County workers used laptops and cellular connections for internet access while systems were restored, and officials said they had seen no evidence that files or data were exfiltrated.

Investigators said there was no indication the attackers reached GARViS itself. CISA examined artifacts of the unauthorized access in activity, network and monitoring logs. It was at least the second cyberattack on a Georgia county in 2024, following a January ransomware attack on Fulton County.