Albemarle County: Summer ransomware attack impacted residents and employees

Albemarle County has completed an investigation into a ransomware attack this summer and found that the data breach may have included current and past employees, county residents, businesses and others who have applied for or received services from the county.

Complimentary credit monitoring, fraud consultation and identity restoration services are being offered to anyone who may have been included in the breach. Enrollment details and a resource guide are available online.

The deadline to register for the service is March 17, 2026.

“No organization is immune to today’s cyber threats. We had response plans and insurance in place to limit the impact of this incident,” said Kristy Shifflett, Chief Operations Officer. “Since the attack, we completed a comprehensive review of our systems, strengthened cybersecurity safeguards, and will continue to evaluate and enhance our defenses based on expert guidance.

“While cyberattacks are an unfortunate and increasing reality for public sector institutions, we are treating this as an opportunity to strengthen our systems and enhance our long-term resilience.”

ICYMI

• Albemarle County: Residents, employee data stolen in recent cybersecurity breach

According to an update from the county, the attack began on the afternoon of June 10 and was perpetrated overnight, resulting in access to approximately 185 gigabytes of data. Cybercriminals attempted to lock up the data and demand a ransom. Because the county had appropriate backups in place, no ransom was paid to the cybercriminals.

As part of the investigation, each of the affected files was scanned for viruses and reviewed to better understand the individuals impacted in the cybersecurity event.

The comprehensive review determined  that data of current and former local government and public school employees and their dependents related to the county’s self-insured health plan was compromised and may include full names, addresses, phone numbers, emails, social security numbers, dates of birth, employee and user ID numbers, health care ID numbers, account/patient ID numbers, health details related to the payment of care received, invoice numbers for medical care received, the names of medical providers, the dates of medical services, billing and claim information and health insurance information including subscriber, beneficiary, policy, member and group numbers.

It was also determined that personal identifying information of current and former local government and public school employees and their dependents, Albemarle County residents, those who have done business with the County, and those who have applied for or received services from the County was potentially accessed. That information may include personal information such as names, addresses, driver’s license numbers, Social Security numbers, passport numbers, military ID numbers, and state ID card numbers.

Not all information was affected for every individual.