Ohio Auditor Cyberattack: Foreign Actors Blamed as State Website Goes Offline

Print Date: Oct 27, 2026 || Published Date: Oct 27, 2026

Ohio Auditor Cyberattack: Foreign Actors Blamed as State Website Goes Offline

Ohio Auditor of State Keith Faber said on Tuesday, October 27, 2026, that overseas cybercriminals and possible foreign state actors were behind a cyberattack on his office on October 25, an attack that forced the Ohio Auditor of State to take its web server and online accounts offline. The Ohio Auditor cyberattack did not, according to Faber, lose any data or put Ohioans' financial information at risk, but the office's website was still offline on Tuesday afternoon, and audit clients were warned they may have trouble with online payments while a temporary platform is built.

Key Points

Ohio Auditor Keith Faber said overseas cybercriminals and possible "foreign state actors" were responsible for the October 25 attack.
The office detected and quarantined the threat immediately, then took its web server and online accounts offline, Faber said.
Faber said the attack was not a ransomware attack, but he did not say what kind of cyberattack it was.
No data was lost, thanks to backups, and payments run through a separate portal that was not on the attacked web server, Faber said.
State and federal law enforcement are investigating, and the office is building a temporary web platform while the main site stays down.

What Happened

The Columbus Dispatch reported on Tuesday that the Ohio Auditor of State's Office took its web server offline because of the cyberattack, and that Faber blamed overseas cybercriminals and possible foreign state actors in an October 27 statement. The office detected the threat and quarantined it immediately, Faber said, and then took its web server and online accounts offline as a precaution. State and federal law enforcement are now investigating, and the office says it is cooperating with them while it works to protect its data and determine the extent of the attack.

Faber was careful about what he did not claim. He said the attack was not a ransomware attack, but he did not specify what kind of cyberattack it was, and he did not name a country, a group, or a method. That distinction matters: "foreign state actors" in his statement is a possibility he raised, not a confirmed attribution, and readers should treat it as the auditor's assessment of who may be responsible, pending whatever law enforcement finds. The office also did not say when its website will return, only that it is working on a temporary web platform and asking for patience until the permanent server is back online.

On the practical side, Faber sought to draw a line between what was hit and what was not. The office did not lose any data, he said, because staff are careful to back up files, and he said the office does not believe the financial information of Ohioans or of audited government agencies is at risk. Payments, he added, go through a separate government portal, and the data behind those payments was not on the office's web server. The one disruption he did flag was for audit clients: they may have issues with online payments while the main site is down, a problem the temporary platform is meant to ease.

Background and Context

The Auditor of State is one of five independently elected statewide offices in Ohio, and it is responsible for auditing more than 5,900 state and local government agencies, according to the office's own recent releases, which in other releases put the figure at more than 6,000. Under Faber, the office also provides financial services to local governments, investigates and prevents fraud in public agencies, and promotes transparency in government, including through its Special Investigations Unit, which handles tips about suspected fraud. That breadth is why an attack on the auditor's website matters beyond a single broken web page: the office is the place where cities, counties, school districts and other public bodies file financial reports, and where the public can look up audit results.

It is also worth stating what this attack is not. The Auditor of State does not run Ohio's elections, so nothing in Faber's statement suggests votes or voter rolls were affected. The risk he described is to the office's own web presence and to audit clients' online payments, not to ballots, and no election official has linked this incident to the November 3 midterm vote. Faber is also the Republican candidate for Ohio attorney general, a separate race that has drawn attention in the same campaign season, but his statement on Tuesday was issued in his capacity as auditor, about his own office's systems.

Ohio has been trying, in law, to get ahead of exactly this kind of incident. Ohio Revised Code section 9.64, enacted through House Bill 96, requires political subdivisions, meaning counties, townships, municipal corporations and similar bodies, to adopt a cybersecurity programme that safeguards their data, information technology and resources. The Auditor of State's Bulletin 2025-007 set out the requirements, which took effect on September 30, 2025. Under the framework described in state guidance, a subdivision must notify the Ohio Department of Public Safety as soon as possible and no later than seven days after discovering an incident, through the Ohio Cyber Integration Center, and must notify the Auditor of State within 30 days. Counties and cities were due to have a programme adopted by January 1, 2026, and every other political subdivision by July 1, 2026. A ransomware payment, under the same framework, cannot be made unless the subdivision's legislative authority formally approves it in a resolution or ordinance stating why paying is in its best interest.

Ohio Auditor Cyberattack: What Faber Said, and Did Not Say

Faber framed the incident as part of a much larger pattern, not as a one-off. "On a near-daily basis, we see reports of private and public entities targeted by criminals," he said. "The measure of an office is not whether it is subject to such an attack but rather how it responds to these very common threats." That framing is consistent with what his office has told lawmakers and the public before: Ohio's local governments are frequent targets, and the question is whether they detect, contain and report attacks quickly, rather than whether they can prevent every attempt.

The numbers behind that warning are stark. The Auditor's Office told cleveland.com that nearly two dozen Ohio political subdivisions were hit by hackers last year, according to an Ohio Senate account of Faber's remarks. In testimony summarised from a legislative committee hearing, the auditor's office said that since January 2023 it had been told of at least 221 incidents, with nearly $11.2 million in reported losses, of which roughly $3.4 million was recovered or stopped, leaving about $7.8 million in net loss among the reported cases. Those figures are based on reports made to the office's Special Investigations Unit and are not exhaustive, the testimony cautioned, which means the true total could be higher.

Other Ohio cases show how different the outcomes can be. The City of Columbus was hit by a crippling attack last year, according to the same Ohio Senate account, which says the city council approved $23 million in cyber upgrades and a $4 million ransom payment to the hackers, and that Social Security numbers, the identities of officers who might have been working undercover, and the details of people who had walked into City Hall were among what was jeopardised. A separate Ohio technology review reported that in May 2025 a ransomware gang disabled key services in Washington Court House and leaked sensitive city data. And a local-government software review summarising Faber's remarks put the toll over the past three years at more than 150 cyber incidents affecting counties, municipalities, townships, school districts, villages and other public entities, with confirmed losses ranging from a few thousand dollars to $1.9 million in individual cases. The October 25 attack on the auditor's own office, by contrast, is presented by Faber as contained, with no data lost and no ransom involved, which is the outcome the state's new reporting and preparation rules are designed to produce.

Reactions and Quotes

Faber's own statement is, so far, the main public account of the attack, and it is notably short on technical detail. He did not describe the malware, the entry point, or the systems affected beyond the web server and online accounts, and he did not say whether any individual or agency had been contacted by the attackers. That restraint is normal in the first days of a law-enforcement investigation, when disclosing methods can help other attackers, but it also leaves the public with a gap: the difference between "overseas cybercriminals" and "foreign state actors" is large, and only the investigation can narrow it.

The Dispatch's reporting adds one firm fact to Faber's statement: the website remained offline as of early afternoon on Tuesday, October 27, which means the outage lasted at least two days from the October 25 attack. The Cincinnati edition of the same report put the site as offline as of about noon on Tuesday, a small timing difference that does not change the picture. No other Ohio agency has publicly commented on the attack in the reporting reviewed, and neither state nor federal law enforcement has named a suspect or a country. Until they do, the safest reading is Faber's own: an overseas attack, possibly involving state actors, that was caught and quarantined, with the damage limited to the office's public web presence.

Why It Matters

This attack matters for three reasons, and none of them requires overstating what happened. First, it hit the watchdog itself. The Auditor of State is the office that tells Ohio taxpayers whether their local governments kept their books in order, and when its own website goes dark, the public's window into those audits closes with it, even if only temporarily. Second, it is a live test of Ohio's new cybersecurity regime. The state spent the last year telling its smallest governments to write a plan, report quickly, and think twice before paying a ransom, and now the office that helped write those rules has had to follow its own playbook in public. Third, it lands a week before the November 3 midterms, when trust in public institutions is already under strain, and when any suggestion of foreign interference, even unproven, travels fast. Faber's decision to name the possibility of foreign state actors, while also stressing that no data was lost, is an attempt to hold both of those truths at once: the threat is real, and the damage, on the evidence so far, is limited.

For Ohio's local governments, the lesson is practical rather than political. Backups, a separate payments portal, and a willingness to take systems offline quickly are what turned this incident, on Faber's account, from a potential data breach into a website outage. Those are the same steps the state's cybersecurity programme asks of every township, village and school district, and the auditor's own experience is now the most public example of why they matter.

What Happens Next

The next steps are, in order, an investigation, a temporary platform, and a return to normal service. Law enforcement will try to determine who was behind the attack and how they got in, and whether the "foreign state actors" possibility holds up. The office will stand up its temporary web platform so audit clients can make online payments, and then restore its permanent server once it is satisfied the threat is contained. Faber has not given a date for either step, so audit clients and members of the public who need audit reports should expect the site to remain disrupted in the short term and check back rather than assuming a quick fix. If investigators do attribute the attack, or if the office discloses a different kind of attack than first described, that will be the next news in this story, and it will matter more than the initial statement, because attribution, not suspicion, is what turns a cyber incident into a foreign-policy question.

Frequently Asked Questions

What happened to the Ohio Auditor of State's website? The office took its web server and online accounts offline after a cyberattack on October 25, 2026, and the site was still offline on the afternoon of October 27, while a temporary platform is built.

Who was behind the Ohio Auditor cyberattack? Auditor Keith Faber said overseas cybercriminals and possible foreign state actors were responsible, but no country or group has been named, and law enforcement has not confirmed an attribution.

Was it a ransomware attack, and was any data lost? No. Faber said the attack was not ransomware, that the threat was detected and quarantined immediately, and that no data was lost because of backups.

Is Ohioans' financial information at risk? Faber said the office does not believe so. Payments go through a separate government portal whose data was not on the attacked web server, although audit clients may have trouble with online payments for now.

Does this affect Ohio's elections? No evidence suggests so. The Auditor of State does not run elections, and nothing in Faber's statement links the attack to votes, voter rolls, or the November 3 midterms.