Virginia attorney general's office hit by cyberattack, shuts down systems
Learn More
The Virginia Attorney General's Office was hit by what officials describe as a "sophisticated cyberattack" on Wednesday 12th of February 2025, causing a disruption of their operations.
The incident was detected early Wednesday morning, prompting the shutdown of nearly all computer systems. The attack forced the agency's 700 employees to rely on smartphones for communication.
The cyber incident has severely impacted the state's law firm operations, which handles sensitive legal matters for state agencies, boards, commissions, and universities. The disruption has forced the office to revert to paper-based court filings, with special arrangements made with the Supreme Court of Virginia and the Court of Appeals of Virginia to accommodate this temporary measure.
The office notified multiple law enforcement and security agencies, including the FBI, Virginia State Police, and the Virginia Information Technologies Agency. Officials have expressed confidence that the attack was caught in its early stages, suggesting that potential damage and data leaks will be minimal.
The attack's remains under investigation, and officials have not yet publicly disclosed the extent of potentially compromised data. The nature of the attaci is not declared but it's very possible to be a ransomware.
No ransom demands have been received from the attacker or attackers, and no other state agencies appear to have been targeted in this incident.
Update - as of 20th of March 2025, тhe ransomware group Cloak has claimed responsibility for the cyberattack. They added the Virginia Attorney General's Office to their list of victims on their Tor leak site. The group stated that the "waiting period" had expired and claimed they had stolen 134GB of sensitive data. Initially, they published screenshots of the stolen information as proof of the attack, but now the complete archive is available for download from their leak page.
The Virginia Attorney General's Office has not shared further details about the attack, and the full extent of the breach's impact remains unclear.
