Alabama Board of Nursing

Summary

The Alabama Board of Nursing experienced a cyberattack that took its online licensing system offline, leaving approximately eighty thousand nurses unable to renew their credentials and delaying licensure for recent graduates. The board has kept the system offline while it investigates the incident, works with external cybersecurity experts and state resources, and focuses on protecting licensee data. In the meantime, paper applications are being accepted and processed at designated community college sites, though renewals still lack an online option. Officials have not disclosed the attacker’s identity, the scope of any data breach, or a timeline for full service restoration, noting that recovery will proceed in phases as systems are validated.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On September 1, 2026, the Alabama Board of Nursing announced that some of its online services and systems would be unavailable due to a cybersecurity event, and those services have remained offline ever since. The board said it took the systems offline deliberately to assess the damage and to protect licensee data. Alabama's nursing license renewal window opened on September 1 and runs through December 31, affecting about 80,000 registered nurses who are due to renew their licenses during this period. New graduates who have passed the NCLEX are also unable to receive an Alabama license number while the online system is down. Recovery efforts have continued to progress, with some systems and services restored in phases as they are reviewed, validated, and determined ready for operation. The board has indicated that restoration of the full technology environment will take additional time and that services may remain temporarily unavailable or experience delays as recovery continues.

To accommodate applicants while the online system is offline, the board has made paper applications available for new RN and LPN graduates, advanced practice nurses seeking initial approval, reinstatements, and new collaborations, and has stated that incomplete applications will not be processed. Paper applications must be submitted in person or by mail; they are not processed at collection sites but are sent to the board's Montgomery office for handling. The board has scheduled collection events at several community college campuses on specific dates in September, with staff present from 9:00 a.m. to 5:00 p.m. to receive forms. In the meantime, the board began posting a running list of successful NCLEX applicants on its website starting September 8, indicating that those individuals are legally authorized to practice in Alabama. Employers are directed to verify licensure through the NURSYS national nurse licensure database, which contains data through August 31, and to consult the board's recently licensed list updated daily. The board has warned of scams involving spoofed phone numbers and forged documents, stating that no board employee will request secrecy or immediate payment of a fee. Probation and VDAP participants are currently unable to access monitoring applications within the board's system due to the cybersecurity incident, although the random drug screening program remains in effect and participants are not required to complete self-reports due September 5, but that information should be included in the report due October 5.

Honor Ingels, the board's chief policy and communications officer, has repeatedly stated that protecting licensees' data is the agency's number one priority. Dr. Natalie Baker, the board's executive officer, said in a September 10 statement that the investigation remains active and ongoing, that the board is working with outside cybersecurity professionals and state resources, and that officials cannot yet draw conclusions about the nature or scope of the event. The board has not disclosed who is behind the attack, what data may have been taken, or when full services will be restored, noting that the investigation has no announced end date. Staff are securing data and wiping compromised devices as part of the response, and the board said it has processed every application it has received so far. The board said it will continue to provide updates as the investigation develops and that no claim of responsibility has appeared in public reporting. The board has also not confirmed whether licensee data was stolen, emphasizing that every decision is based on its mission to safeguard and promote the public health, safety, and welfare through licensing and approval of qualified individuals.

Sources

Sources available to members: 5 sources.