St. Clair County

Summary

St. Clair County experienced a cyberattack targeting its systems, prompting immediate mitigation and remediation efforts to address potential compromises in hardware and software. County crews worked over several days to secure the infrastructure, with officials confirming that no data was exfiltrated or stolen during the incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On September 21, 2020, at approximately 7:00 p.m., St. Clair County, Alabama, experienced a cyberattack targeting its systems. County Commission Chairman Paul Manning publicly confirmed the incident, characterizing it as an unauthorized intrusion into the county's digital infrastructure. The attack prompted immediate defensive actions by county personnel, who initiated mitigation and remediation procedures to address potential compromises in hardware and software components. Technical crews worked to isolate affected systems and prevent further unauthorized access, prioritizing containment of the breach. County officials emphasized their proactive response, stating no data had been exfiltrated from their systems during the initial stages of the incident. The attack disrupted normal county operations, though specific departmental impacts were not detailed in public statements.

Response efforts continued intensively over subsequent days as technical teams conducted system-wide assessments and implemented additional protective measures. By September 24, 2020—three days post-attack—the county reiterated its preliminary assessment that no sensitive data had been stolen during the breach. The investigation focused on securing infrastructure rather than recovering lost information, suggesting attackers were blocked before achieving data extraction. No ransomware claims or specific attacker methodologies were disclosed publicly. The county maintained transparency about the ongoing remediation without specifying which systems were targeted or the attack's technical origin. Recovery work prioritized restoring secure operations while maintaining the integrity of county data repositories throughout the incident lifecycle.

Sources

Sources available to members: 1 source.