Ohio auditor says overseas cybercriminals attacked web server

The office detected and quarantined the threat with threat monitoring services already in place, Faber said. Out of an abundance of caution, it took the web server and online accounts offline while internal and external experts scrutinize the threat activity, the statement said. The office notified state and federal law enforcement, which is working with it to identify those involved. Faber led a meeting of his senior team to determine what happened and map next steps, the statement said. The attack came on Sunday, Oct. 25, and the statement went out on Tuesday, Oct. 27, two days later. It did not give a figure for affected accounts or systems.

Payments and audit work

The office audits state entities as well as counties, cities, villages and school districts, Faber said. Payments to the Auditor of State's Office go through a separate state government portal, and that data is not on the impacted web server, he said. Audit clients may experience issues with online payments; a grace period will be offered until further notice. Day-to-day audit work continues without the web server, the statement said. A temporary web platform will be made available in the coming days to continue communicating with the public and government organizations, with no fixed date. The permanent server remains offline, and the statement gave no date for its return. Faber asked for patience until it is back online.

What the office says is at risk

Faber said there is no evidence the attack put Ohioans' personal financial information at risk. He also said he has no reason to believe the financial information of the government entities the office audits is at risk. The office typically does not work directly with individual citizens, so Faber said he does not expect Ohioans to take protective measures because of the incident.

Faber said the attack was not ransomware. Because the office is careful about backups, it still has all the data it had before the attack, according to the statement.

What remains unknown

Faber described the attackers as overseas cybercriminals and potentially foreign state actors but did not identify a country or group. He said the office will continue to protect its data, find out the extent of the attack, cooperate with law enforcement and tell the public more when it knows more. He said the office sees reports of private and public entities targeted by criminals on a near-daily basis, and that the measure of an office is how it responds to these common threats.