Alabama OIT Cyberattack: What State Employees Know
Updated: Oct 6
Reviewed and updated October 6, 2026.
The Alabama Office of Information Technology reported that the state detected a cybersecurity event on May 9, 2025. Its final public update, dated May 20, said the event had been contained and neutralized, some employee usernames and passwords had been compromised, and investigators had found no evidence that Alabama residents’ personally identifiable information was taken.
Those are the state’s reported findings. They do not establish that no risk ever existed, but they do not support describing every state employee—or any particular resident—as a breach victim. They also do not support a claim that 29,000 people had data stolen.
The official timeline
The Governor’s press-office update said on May 12 that:
the incident was detected May 9;
certain state systems were affected;
some employee usernames and passwords were compromised;
investigators then believed no Alabamian’s personally identifiable information had been retrieved; and
a third-party firm was helping investigate.
On May 13, OIT reported that two outside incident-response firms were involved, no major system disruptions had been traced to the event, no evidence showed exfiltration of resident personal information, and executive-branch employee passwords were being reset statewide as a precaution.
In its May 20 final public update, OIT said the event was contained and neutralized, it had detected no further unauthorized activity, and it could not attribute the attack to a particular actor. OIT said future communications would be limited to directly affected agencies unless circumstances changed.
What the updates do not prove
OIT warned employees to be cautious about suspicious email. That is prudent after a credential event, but it does not prove that phishing was the route of entry. The public updates do not identify the technical cause, name an attacker, state that ransomware was deployed, or quantify a victim population.
Similarly, a statewide password reset does not mean that every reset account was compromised. OIT described the reset as a precaution. A workforce estimate is not an incident victim count and should not appear in the headline as though it were one.
The current OIT public document library did not reveal a later incident update that reversed the May 20 findings. Because OIT said later communication might be directed only to affected agencies, the absence of a new public bulletin cannot prove that no agency-specific follow-up occurred.
Sensible steps for state employees
Employees should follow their agency’s current security instructions. In addition:
Use a unique password for state access and do not reuse it on personal accounts.
If the old state password was reused anywhere else, change those accounts from a trusted device.
Use multifactor authentication where available and reject unexpected approval prompts.
Treat password-reset messages, payroll changes, benefit messages, and document-sharing requests as untrusted until verified through an agency directory or known help desk.
Preserve suspicious messages and report them through the agency’s information-security officer. OIT’s incident-reporting page explains the state reporting route.
A credit freeze is not required merely because the state reset a password. But an employee who later receives notice that a Social Security number or comparable identity data was exposed may consider the FTC’s freeze and fraud-alert guidance.
When a personal claim may require closer review
A cyber event and a viable individual damages claim are not the same thing. Relevant evidence could include a direct agency notice, an unauthorized payroll or benefits change, verified account takeover, fraudulent debt, an unreimbursed expense, or another concrete loss traceable to compromised information.
If you have that kind of documented consequence—not only a precautionary password reset—preserve the agency messages and loss records and request an initial case evaluation. For a municipal incident involving mailed notices, see the Gardendale data-breach guide.
Primary sources
This article provides general information, not legal advice. Cyber-incident information can change; follow verified instructions from your agency or OIT. Reading this article or contacting the firm does not create an attorney-client relationship. Representation begins only after the firm accepts the matter in writing. Do not send passwords, account numbers, government records, confidential information, or time-critical material through a website form.
