MalwarePIIPHIIdentity (basic)Government IDHealth (basic)MediumContained

Alabama Board of Nursing

bd_bd9099f27644c17d · schema v1 · pii pii-v2

Severity

Medium

Discovered

Sep 1, 2026

Filed

Oct 21, 2026

To disclose

7 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

67%

Full breach record for Alabama Board of Nursing →

The Alabama Board of Nursing experienced a ransomware attack in August 2026, with malicious activity confirmed by September 1, 2026. While containment prevented further escalation, data was exfiltrated, potentially exposing SPII and PHI (including SSNs, driver's licenses, and medical info) of licensees and applicants. The Board notified the Iowa AG regarding Iowa residents, cooperated with the FBI and state law enforcement, took systems offline, and is restoring services with enhanced security controls.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 31 days

discovery → filing · 7 weeks / 50 days

Aug 1, 2026

Begins

Sep 1, 2026

Discovered

Oct 21, 2026

Filed

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_c1bd2e7edf5bc3542026-10-21Candidate

Name: Alabama Board of Nursing
norm: alabama board of nursing
Domain: abn.alabama.gov

Name: Alabama Board of Nursing
norm: alabama board of nursing
Domain: abn.alabama.gov

Discovered: Sep 1, 2026
Breach occurred: Aug 1, 2026 – Sep 1, 2026
Undetected for: 31 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)Government IDHealth (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Iowa Attorney GeneralCooperating with the Federal Bureau of InvestigationsCooperating with the Alabama Law Enforcement Agency

During the incident: Coordinated with the Alabama Office of Information Technology (OIT) and outside cybersecurity specialists, including a third-party incident response team
Contained the unauthorized activity
Investigated the scope of the occurrence
Plan for restoration services
Strengthen ABN's technology environment
Cooperating with the Federal Bureau of Investigations and the Alabama Law Enforcement Agency
Took the affected systems completely offline
Contained the known malicious footprint
Progressively restoring secure services
Changes made: Enhanced cybersecurity controls, advanced network monitoring tools, and additional credential authentication practices have been and will continue to be deployed
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(50 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGOct 21 · first

Iowa State AGOct 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.iowaattorneygeneral.gov/media/cms/10212026_Alabama_Board_of_Nursing_89840EB70C46E.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 21, 2026
Raw hash: 07cbf066de10a03063bb6cad25ea7a868651979536853fc268709cd6a3a0455f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAlabama Board of Nursing

Victim entityAlabama Board of Nursing

Incidentdiscovered Sep 1, 2026

Stated responseCoordinated with the Alabama Office of Information Technology (OIT) and outside cybersecurity specialists, including a third-party incident response team

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.iowaattorneygeneral.gov