Share This Article
Article Summary
The Ohio Auditor of State’s Office took its web server and online accounts offline after a cyberattack over the weekend. Auditor Keith Faber said overseas cybercriminals were responsible and raised the possibility of foreign state involvement. Officials reported no evidence that personal or government financial information had been compromised. The office is cooperating with law enforcement while working to restore affected online services.
The Ohio Auditor of State’s Office took its web server and online accounts offline after a cyberattack over the weekend, according to a statement from Auditor of State Keith Faber on Tuesday.
The office is investigating the incident with law enforcement agencies.
Officials have not publicly identified the perpetrators or disclosed the exact method used in the attack as of this writing.
Faber said overseas cybercriminals were responsible for the attack and raised the possibility of foreign state involvement. However, investigators have not publicly confirmed the identities or affiliations of those responsible.
The temporary shutdown is intended to help investigators examine the threat and protect the office’s systems while the investigation continues.
Officials report no evidence of compromised financial information
The Auditor of State’s Office said it had found no evidence that Ohioans’ personal financial information or the financial information of government entities audited by the office had been compromised.
Faber also said the incident was not a ransomware attack. The office retained its data through backup systems, according to reports about his statement.
Officials have not disclosed the full technical details of the incident.
The investigation will help determine the nature and extent of the attack and whether any information or services were affected.
Cyberattack could disrupt some government payments
The shutdown may create temporary difficulties for government entities that rely on the Auditor of State’s Office for financial services.
According to reports, Faber said some audit clients could experience problems making online payments. The office announced a grace period for affected clients until further notice.
The office also planned to establish a temporary website to provide information to the public and government agencies while officials work to restore the permanent web server.
Despite the disruption, Faber said regular auditing work would continue. The office’s email accounts also remained operational, according to published reports.
Cyberattacks have repeatedly affected Ohio local governments
The attack comes amid a broader pattern of cybercrime involving Ohio’s public sector.
In January 2026, the Statehouse News Bureau reported that the Ohio Auditor of State had recorded more than 150 cybercrime incidents involving local governments over a three-year period.
The incidents affected public entities such as counties, cities, townships, villages and school districts. Reported cases included fraudulent payment schemes and other cybercrime incidents that exposed government organizations to financial losses.
These figures demonstrate that cybersecurity problems extend beyond major state agencies. Smaller public institutions can also face threats that disrupt operations or compromise public funds.
However, the reported incidents involving local governments should not be treated as a direct count of attacks against state agencies. The two groups have different reporting requirements, systems and responsibilities.
Government payment scams create financial risks
Cyberattacks against government agencies do not always involve shutting down computer systems or stealing large amounts of data.
One recurring threat involves payment-redirection schemes, in which criminals impersonate vendors or employees and persuade government offices to transfer money to fraudulent accounts.
In April 2024, the Ohio Auditor of State reported that at least 23 government offices had experienced payment-redirection attacks over the preceding 12 months.
These schemes can cause significant financial losses without requiring criminals to deploy ransomware or disable an agency’s website.
Government organizations can reduce their exposure by verifying payment changes through trusted communication channels, strengthening email security and training employees to recognize suspicious requests.
Ohio introduces cybersecurity requirements for local governments
Ohio has taken steps to strengthen cybersecurity practices among local public entities.
House Bill 96 established new cybersecurity requirements for covered local government entities, effective September 30, 2025, according to the state’s cybersecurity office.
The requirements include establishing a basic cybersecurity program and reporting qualifying cybersecurity incidents to the Ohio Cyber Integration Center and the Auditor of State. Covered entities must also obtain approval from the appropriate legislative authority before paying a ransomware demand.
The measures are intended to improve preparedness, strengthen incident reporting and encourage local governments to establish procedures for responding to cyber threats.
However, cybersecurity requirements cannot guarantee that attacks will not occur. Government agencies must continue to assess vulnerabilities, train employees and maintain incident-response plans.
FAQs
Who is responsible for the cyberattack?
Auditor Keith Faber attributed the attack to overseas cybercriminals and raised the possibility of foreign state involvement. However, the identities of those responsible have not been publicly established.
Can a government website be attacked without personal information being stolen?
Yes. A cyberattack can disrupt a website, compromise an account or interfere with computer systems without necessarily resulting in data theft. Investigators must determine whether attackers accessed sensitive information before confirming a data breach.
