Cyber Incident Victim: Federal Public Defender for the District of Arizona
Date:
Apr 2025
Location:
United States of America
Summary
A ransomware attack targeting the Arizona Federal Public Defender’s Office disrupted legal proceedings in a death penalty case, delaying a competency briefing for inmate Ralph Menzies. The breach erased a nearly completed draft brief and forced system shutdowns, restricting work access due to security protocols. While IT teams assess potential data recovery, the defense secured an extension to rebuild the filing after the state offered assistance with case materials. Court arguments were postponed as a result, pending resolution of the cybersecurity incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
A ransomware attack targeting the Arizona Federal Public Defender’s Office disrupted critical legal proceedings in the death penalty case of Utah inmate Ralph Menzies, causing significant operational delays. The attack compromised the defense team’s access to case files and erased a nearly completed 25-page draft reply brief addressing Menzies’ mental competency for execution. Following the breach, the office shut down its systems entirely and barred employees from using personal laptops to mitigate further risks, halting all work on the case. Defense attorneys formally requested a deadline extension on April 1, 2025, citing the cyberattack’s impact on their ability to reconstruct the lost brief and prepare arguments. The State of Arizona, while not opposing the delay, offered to share discovery files and exhibits from its own records to assist the defense in recovering the lost work.
The court granted the defense’s motion, extending the reply brief deadline to April 18 and rescheduling oral arguments from April 18 to May 7, 2025. The office’s IT team remained engaged in assessing the scope of data loss and system damage, with no confirmation on whether compromised files could be recovered or when normal operations would resume. The competency briefing delay directly affected the court’s ability to evaluate whether Menzies, convicted in 1986 for the kidnapping and murder of Maurine Hunsaker, comprehends his impending execution. This incident marked the latest disruption in a case spanning nearly four decades, with Menzies having spent most of that time on Utah’s death row. Operational restrictions and system outages persisted indefinitely as investigators worked to secure the office’s networks, underscoring the attack’s tangible impact on judicial timelines and constitutional due process safeguards.