Ohio's Auditor of State is the office that audits more than 5,900 public entities, collects cyberattack reports from local governments, and helped write the state's new cybersecurity rules for them. Over the weekend, it became the latest victim itself.
Auditor Keith Faber said in an October 27 statement that overseas cybercriminals and possible "foreign state actors" were behind an October 25 attack on the office, according to The Columbus Dispatch. The office detected and quarantined the threat immediately, then took its web server and online accounts offline. The website was still down as of early afternoon on October 27, and the office is building a temporary platform while the permanent site is restored.
Faber said the attack was not ransomware but did not specify what kind it was. No data was lost — the office credits its backups — and it does not believe financial information belonging to Ohioans or audited agencies is at risk, since payments run through a separate government portal. State and federal law enforcement are investigating. The practical fallout is narrower but real: audit clients may have trouble making online payments until the temporary platform is up.
The irony is hard to miss. Under Ohio's new cybersecurity rules, local governments must adopt cyber policies, train employees, and report incidents to the auditor's office and the Department of Public Safety. Faber's office is now, in effect, filing its own incident report. The rules were written after a wave of attacks across the state: Columbus paid a $4 million ransom after a 2024 ransomware attack that exposed residents' personal data, and the auditor's office has said 23 local governments were hit by payment-redirect scams in a single year.
"On a near-daily basis, we see reports of private and public entities targeted by criminals," Faber said. "The measure of an office is not whether it is subject to such an attack but rather how it responds to these very common threats."
He's right that the response matters more than the breach — and so far the response looks like the playbook his office preaches: detect fast, isolate, fall back on backups, disclose. What to watch next is whether investigators can say anything firmer than "possible" about attribution, what kind of attack it actually was, and whether an office that grades everyone else's cyber hygiene ends up tightening its own rules after grading itself.
— via The Columbus Dispatch