Colorado public defender says ransomware attack exposed client data

The Office of the Colorado State Public Defender discovered on February 9, 2024 that data on its computer systems had been encrypted by malware. The agency disabled its network as a precaution, cutting attorneys off from criminal case files, calendars and the state's electronic court filing system.

In mid-March 2024 the office disclosed that files had been copied from its systems in early February and that the material may have included names, Social Security numbers, driver's license or state identification numbers, other government identification numbers, medical information and health insurance identification numbers. Officials said they could not determine how many people were affected or whose records were involved, and advised clients to watch for identity theft and unusual financial activity.

The outage rippled through Colorado's courts. The agency employs about 1,250 people, including 572 attorneys, and handles roughly 130,000 criminal cases a year. Rescheduled hearings rose from about 3,300 in the week before the attack to about 3,900 in the first full week afterwards, with arraignments, pre-trial conferences and plea hearings among those postponed. One chief judge in a rural judicial district warned the pace could not be sustained.

The office contacted law enforcement, worked to reschedule affected hearings and trials, and said further work was needed to return to normal operations. It declined to say how much was demanded or whether any ransom was paid, and did not name the group responsible.