CHARLOTTESVILLE, VA (CVILLE RIGHT NOW) – A recently-concluded investigation into a ransomware cybersecurity attack of Albemarle County’s IT systems this summer revealed the timing and scope of the breach.
The county released the findings of an extensive forensics investigation, conducted in cooperation with the county’s insurance provider, Wednesday.
“No organization is immune to today’s cyber threats,” County Chief Operations Officer Kristy Shifflett said. “We had response plans and insurance in place to limit the impact of this incident. Since the attack, we completed a comprehensive review of our systems, strengthened cybersecurity safeguards, and will continue to evaluate and enhance our defenses based on expert guidance. While cyberattacks are an unfortunate and increasing reality for public sector institutions, we are treating this as an opportunity to strengthen our systems and enhance our long-term resilience.”
The breach exposed personal data of “of current and former local government and public school employees and their dependents, as well as other individuals, including county residents, those conducting business with the County, and individuals who applied for or received services from the County,” according to the release.
The investigation revealed the attack began in the afternoon of June 10, continued overnight. On July 15, the investigation revealed that protected health information (PHI) connected to the administration of Albemarle County’s self-insured health plan was compromised. The county pointed out that PHI information differs from medical records, although it may contain health details due to coverage of costs.
It may also, however, include full names, addresses, phone numbers, emails, social security numbers, dates of birth, employee and user ID numbers, health care ID numbers, account/patient ID numbers, health details related to the payment of care received, invoice numbers for medical care received, the names of medical providers, the dates of medical services, billing and claim information, and health insurance information including subscriber, beneficiary, policy, member and group numbers.
It was also determined that personal identifying information of current and former local government and public school employees and their dependents, Albemarle County residents, those who have done business with the County, and those who have applied for or received services from the County was compromised. That information may include personal information such as names, addresses, driver’s license numbers, Social Security numbers, passport numbers, military ID numbers, and state ID card numbers. Not all information was affected for every individual.
Albemarle County is offering complimentary credit monitoring, fraud consultation, and identity restoration services to current and former employees of the County and its public school system and their dependents, residents, those who have conducted business with the County, and individuals who have applied for or received services from the County. Enrollment details, along with a resource guide for protecting personal information, are available at Albemarle.org/CybersecurityIncident. The deadline to register for the service is March 17, 2026.
