# Ohio Auditor of State Pulls Web Server Offline After October 25 Cyberattack

> Ohio Auditor of State Keith Faber said overseas criminals and possible foreign state actors hit the office on October 25, taking its web server offline.

- Published: 2026-10-27T16:39:21+00:00
- Section: Incidents
- Author: News Desk
- URL: https://newsforagent.com/news/2026-10-27/ohio-auditor-cyberattack-web-server-offline
- Source: [Yahoo](https://www.yahoo.com/news/us/articles/foreign-actors-may-behind-cyberattack-161733582.html)

## Key takeaways

- Ohio Auditor of State Keith Faber said overseas cybercriminals and possible foreign state actors were behind the October 25 attack.
- The office quarantined the threat and took its web server and online accounts offline, and no data was lost.
- Faber said the attack was not ransomware and that payments run through a separate government portal.
- The office is building a temporary web platform while the permanent server comes back online.

The [Ohio Auditor of State](https://akta.pro/company-profiles/000s1ne/ohio-auditor-of-state) took its web server offline after a cyberattack on October 25, with overseas cybercriminals and possible foreign state actors suspected, Auditor of State Keith Faber said in an October 27 statement. [Yahoo](https://www.yahoo.com/news/us/articles/foreign-actors-may-behind-cyberattack-161733582.html) published the statement.

## Faber Details the October 25 Attack

Faber said the office detected and quarantined the threat immediately, then took its web server and online accounts offline. State and federal law enforcement are investigating, and the office is cooperating with them to protect its data and establish the extent of the attack.

Faber said the attack was not a ransomware attack but did not specify what kind of cyberattack it was. The office lost no data because staff are careful to back up files, and it does not believe the financial information of Ohioans or audited government agencies is at risk. Payments go through a separate government portal, and that data was not on the office's web server.

Audit clients may still have issues with online payments, Faber said. The office is working to create a temporary web platform and asked for patience until the permanent server goes back online. The Ohio Auditor of State website remained offline as of about noon on October 27.

"On a near-daily basis, we see reports of private and public entities targeted by criminals," Faber said. "The measure of an office is not whether it is subject to such an attack but rather how it responds to these very common threats."

## What the Office Oversees

The Ohio Auditor of State is a constitutional office that audits all public entities across Ohio's 88 counties, delivering financial and performance audits, Medicaid audits, fraud investigations and fiscal-emergency oversight through seven regional offices, according to akta.pro [company records](https://akta.pro/company-data). The same records show the office has issued 284 findings for recovery since January 2019, totaling $28.7 million, and its Special Investigations Unit has achieved 165 convictions on 376 charges in that period. The office also conducts annual compliance and control reviews of JobsOhio, the private nonprofit created by the state to promote economic development.

## Other Cyber Incidents This Week

Warhorse Studios confirmed a cyberattack that accessed its systems and data, with CEO Martin Frývaldský calling it a serious incident, [gamesradar](https://www.gamesradar.com/games/action-rpg/kingdom-come-deliverance-2-studio-hit-by-cyberattack-ceo-confirms-this-is-a-serious-incident-for-warhorse-studios-and-everyone-affected/) reported on October 27. Rand Mutual Assurance is investigating a possible breach after a threat actor claimed to have stolen 366GB of data, including 1.68 million claims records, [ITWeb](https://www.itweb.co.za/article/rand-mutual-probes-alleged-breach-of-168m-claims/G98YdqLGAgXMX2PD) reported the same day. DreamHost forced password resets for email and FTP/SFTP users after an incident disrupted its File Manager interface, [Bleepingcomputer](https://www.bleepingcomputer.com/news/security/dreamhost-forces-email-ftp-sftp-password-resets-in-ongoing-incident/) reported on October 26.

## When the Server Returns

The office is working to create a temporary web platform while the permanent server comes back online, and state and federal law enforcement are investigating the attack.

## Companies in this story

- [Ohio Auditor of State company profile](https://akta.pro/company-profiles/000s1ne/ohio-auditor-of-state) · website: https://ohioauditor.gov

---
News for Agent · https://newsforagent.com/llms.txt