When the Alabama Board of Nursing’s licensing systems went dark in September, hospitals and clinics felt it first in the hiring queue. Our earlier post covered that outage carefully: paper workarounds, Nursys fallbacks, and scam hygiene — without inventing ransomware details the board had not released.
That caution still matters. Attribution remains unnamed. But the facts have moved. On October 2, 2026, the Alabama Board of Nursing published a press release confirming a ransomware attack, that some data was collected and downloaded, and that Sensitive Personally Identifying Information (SPII) and/or Protected Health Information (PHI) may have been exposed. 1819 News summarized the same update on October 5.
If you employ nurses in Alabama — or hire across the AL/GA/TN corridor — treat this as an employer continuity and identity-risk drill, not just a regulator IT story.
What is confirmed now
Per the ABN October 2 press release:
- A forensic investigation found suspicious activity in August 2026 and confirmed malicious activity in portions of the Board’s environment as of September 1, 2026.
- Containment stopped further escalation of the ransomware attack, but investigators confirmed that some data was collected and downloaded.
- The Board has reason to believe SPII and/or PHI may have been exposed. That environment could have included licensee names, dates of birth, Social Security numbers, driver’s license numbers, professional licensing information, and medical information. Forensics could not prove every nurse, applicant, licensee, or member of the public was fully accessed.
- ABN is cooperating with the FBI and the Alabama Law Enforcement Agency (ALEA), and worked with Alabama OIT plus outside incident-response specialists.
- Affected systems were taken offline; progressive restoration is underway. Enhanced monitoring and stronger credential authentication are part of the recovery.
What is still not confirmed: a named threat actor, a ransom demand, or a firm restore date for online renewals. Do not invent those from silence.
Licensing is still disrupted
1819 News reports that nurses still cannot renew licenses online, and new graduates must use paper applications. That operational hit continues even after the ransomware confirmation. Employers should keep fallback verification paths (Nursys, board lists, paper processes) in the hiring playbook until ABN says online services are securely restored — and only trust updates on the official ABN site.
Why this is an employer problem
Credentialing is a business dependency. Outages delay new grads and endorsements; a possible SPII/PHI exposure raises phishing and identity-theft pressure on staff who reuse portal passwords at work. Clinics that skip MFA on HR and credentialing accounts, or that never brief front desk on post-headline scams, inherit both the outage and the follow-on fraud risk.
Rome and Northwest Georgia operators hiring across the state line share the pattern without an Alabama ZIP: if a regulator portal stays down for weeks and licensees get phishing mail about “the incident,” how would you still verify, hire, and keep staff from handing credentials to impostors?
Clear takeaway
ABN has confirmed ransomware and possible exposure of names, DOB, SSNs, driver’s license numbers, license data, and medical information — while renewals stay offline. Treat that as a hiring-continuity and identity-hygiene drill for nurse employers: keep paper/Nursys fallbacks, force unique passwords and MFA on credentialing workflows, and brief staff that ABN will never ask for passwords by email, text, or cold call.
Actions to take this week
- Keep fallback license-verification paths documented (Nursys, board daily lists, paper apps) until ABN restores secure online renewals.
- Tell nurse employees who reused Board-portal passwords to change those passwords everywhere they reused them — and require unique passwords going forward.
- Require MFA on email, HRIS, credentialing portals, VPN, and shared onboarding accounts.
- Brief HR and front desk on phishing: unexpected messages about licenses, renewals, fees, refunds, “investigations,” or credit monitoring are high-risk. Do not click links or give personal info. Rely only on abn.alabama.gov updates; ABN contact for this incident: cybersecurityevent@abn.alabama.gov / P.O. Box 303900, Montgomery, AL 36130-3900.
- Encourage credit monitoring hygiene for affected staff: freeze or fraud alert options are free; IdentityTheft.gov for suspected theft.
- Map regulator dependencies that can block hiring if portals go dark — and name who owns the workaround.
Brotherly Technology helps medical clinics, dental practices, and healthcare SMBs across Rome, Northwest Georgia, and metro Atlanta turn regional regulator cyber headlines into a short continuity and identity review — without inventing threat actors a board has not named. ABN’s confirmed ransomware update is the cue to run that drill now.
Sources:
- Alabama Board of Nursing — Final Press Release (PDF), October 2, 2026 — ransomware confirmation; data collected/downloaded; possible SPII/PHI including names, DOB, SSNs, DL #s, licensing and medical info; FBI + ALEA; OIT + IR partners; protective steps for licensees.
- 1819 News — Daniel Taylor, October 5, 2026 — summarizes ABN confirmation; renewals offline; paper apps for new grads; protective measures.