Courts have halted Pa. Attorney General's Office cases after a ransomware attack

Abraham Gutman, The Philadelphia Inquirer on Sep 2, 2025

By clicking submit, I authorize Arcamax and its affiliates to: (1) use, sell, and share my information for marketing purposes, including cross-context behavioral advertising, as described in our Privacy Policy , (2) add to information that I provide with other information like interests inferred from web page views, or data lawfully obtained from data brokers, such as past purchase or location data, or publicly available data, (3) contact me or enable others to contact me by email or other means with offers for different types of goods and services, and (4) retain my information while I am engaging with marketing messages that I receive and for a reasonable amount of time thereafter. I understand I can opt out at any time through an email that I receive, or by clicking here

State and federal courts in Philadelphia have paused cases connected to the Pennsylvania Attorney General's Office after the law enforcement agency fell prey to a ransomware attack in August.

The office confirmed the cyberattack publicly in a Friday statement, saying the "interruption was caused by an outsider encrypting files in an effort to force the office to make a payment to restore operations."

"No payment has been made," the statement said.

The computer network for the state's top law enforcement agency has been down since Aug. 11.

"Office of Attorney General staff are unable to access any litigation data, which prevents our attorneys from contacting witnesses, timely responding to pleadings, conducting discovery, or otherwise proceeding with litigation," the office said in an Aug. 12 letter to the Philadelphia Court of Common Pleas.

The agency had made "substantial progress" in restoring its tech functionality, the Friday statement said, and a majority of the agency's 1,200 employees now have access to email.

The office said that it was unable to provide more information because of an investigation into the hack.

A spokesperson declined to say whether there was concern that the hackers obtained sensitive information, but the office's statement said it did not expect negative impacts on cases "solely due to the outside interruption."

Still, court stays on proceedings in which an attorney from the attorney general's office is involved remain in place.

Judge Daniel Anders, an administrative judge at the Philadelphia Court of Common Pleas, issued an order Aug. 13 halting all civil cases in which the attorney general's office is involved for 30 days. Nearly 200 cases have been paused, the court said.

More than a week later, on Aug. 21, Anders also paused all post-conviction relief cases, in which individuals convicted of a crime ask for a new trial, usually on the basis that their attorney was ineffective.

All three federal district courts in Pennsylvania issued similar orders staying civil cases.

Spotlight PA first reported that a ransomware attack was the cause of the disruption.

Attorney General Dave Sunday first announced a "cyber incident" in an Aug. 11 statement, saying, "This is a frustrating situation, and everyone is doing their very best."

The agency restored its website on Aug. 14 and email access on Aug. 18, according to statements.

The agency's portal for submitting complaints is online, though processing time may be delayed due to the outages related to the ransomware attack.

Sunday said he was proud of the way his staff has navigated the situation and found ways to continue working.

"This situation has certainly tested OAG staff and prompted some modifications to our typical routines — however, we are committed to our duty and mission to protect and represent Pennsylvanians, and are confident that mission is being fulfilled," Sunday said in a statement.

_____