Alabama Department of Education stops ransomware attack but confirms data stolen

The Alabama State Department of Education said it stopped a ransomware attack last month but hackers were still able to access some data and disrupt services. 

On June 17, hackers attempted to target servers and lock down the agency’s computer systems, but were prevented from doing so.

“However, the hackers were able to breach some data and disrupt our services before our staff interrupted and stopped the attack,” the department said in a statement on Wednesday. 

Federal law enforcement, as well as the Alabama attorney general, began an investigation, which is currently ongoing. Despite preventing a severe attack, the department acknowledged it “is possible that the hackers accessed some personally identifiable information.” 

The statement did not outline what information was stolen and the department did not respond to requests for comment.

“While we still do not know the exact content of the information, it is possible that the hackers breached both student and employee data, including some personally identifiable information. We are working with the FBI and other experts to monitor the situation,” they said.

The agency has set up a page online to provide updates about the breach. “A dedicated landing page, alabamaachieves.org/databreach has been deployed and will be updated as soon as the investigation is complete, and more information is available.”

The state’s Department of Education runs nearly 1,500 schools across 138 school districts, serving about 750,000 students. 

The department did not explicitly confirm whether they dealt with a ransomware attack but said they have “taken the position not to negotiate with foreign actors and extortioners” on the advice of law enforcement agencies. 

They were able to restore systems and data using clean backups and have taken additional steps to secure their data. 

State Superintendent Eric Mackey said at a press conference on Wednesday  that the department website would be down on July 4 for several hours for updates. It is now back online. 

Earlier this year, the city of Birmingham, Alabama, was hit with a ransomware attack, and this week Florida’s Department of Health confirmed it is investigating a cyber incident after a ransomware gang claimed it stole troves of data.