Alabama OIT Cyberattack (May 2025): What Happened

Update, Oct. 14, 2026: This article was revised and fact-checked on Oct. 14, 2026. Earlier versions included quotes attributed to people we could not verify; those quotes have been removed. All statements below are attributed to published sources.

Summary

• The Alabama Office of Information Technology (OIT) detected a cybersecurity event affecting certain state systems on the evening of Friday, May 9, 2025.
• Some state employee usernames and passwords were compromised. OIT said it found no evidence that Alabama residents’ personally identifiable information was taken.
• Executive-branch employee passwords were reset as a precaution, and outside incident-response firms helped with the investigation.
• On May 20, 2025, OIT said the threat had been neutralized. The state did not attribute the attack to any person or group.

What happened

On Monday, May 12, 2025, the governor’s press office distributed an OIT statement saying the agency was “currently responding to a cybersecurity event that is affecting certain state systems.” The event had been detected the previous Friday evening, according to the statement.

OIT said it had taken immediate steps to contain the situation and was working with “a leading third-party cybersecurity firm to investigate, secure and restore impacted services.” It warned that “temporary disruptions such as website accessibility, as well as email and phone communication, may occur.” AL.com and the Alabama Political Reporter reported the statement the same day.

The statement said “some state employee usernames and passwords were compromised,” but that “it is currently believed that no Alabamian’s personally identifiable information has been retrieved.” State employees were told to watch for potentially malicious emails.

Alabama Medicaid issued its own notice warning of possible temporary interruptions to its website, email and phone lines while it worked with OIT and the governor’s office.

Investigation and response

In later updates, OIT said two outside incident-response firms were involved, that no major service disruptions had been traced to the event, and that passwords for executive-branch employees were being reset statewide as a precaution. A May 16 update said there was “no evidence of exfiltration of the personally identifiable information of Alabama citizens,” The Record reported.

OIT released few technical details. “OIT is not in a position to release additional details at this time,” the agency said in a mid-week update quoted by The Register.

Outcome

On Tuesday, May 20, 2025, OIT issued what it described as its final public update. “Following a thorough investigation and coordinated response, OIT can confirm that the threat has been neutralized and Alabama’s core operations are safe and stable,” the agency said, according to The Record.

The state did not name a culprit. “Unfortunately, OIT is unable to attribute this attack to any specific individual or organization as our efforts have been solely focused on responding to and mitigating the threat,” the update said. OIT added that any criminal investigation would be handled by state and federal law enforcement, and that further communication would go only to directly affected agencies unless circumstances changed.

The state has not publicly identified the attackers, the method of initial access, or the number of accounts affected.

What employees and residents can do

Because the confirmed impact involved employee login credentials, the main lessons concern account security: use unique passwords, turn on multi-factor authentication, and be careful with unexpected emails and links. OIT’s advice to state staff to “remain vigilant when replying to emails and/or clicking any links” applies to anyone.

Sources

• Office of Gov. Kay Ivey / Alabama OIT statement, May 12, 2025 (PDF)
• AL.com, May 12, 2025
• Alabama Political Reporter, May 13, 2025
• The Register, May 19, 2025
• The Record, May 20, 2025
• Alabama Medicaid press release, May 12, 2025

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.