Albemarle offers aid after cyberattack exposes personal data

ALBEMARLE COUNTY, Va. (WRIC) -- Albemarle County has been investigating a cybersecurity attack that exposed the private personal data of employees, and is offering various forms of aid to those impacted.

On the night of June 10, 2025, Albemarle became the victim of a cybersecurity attack. The investigation took several months to complete due to the high volume of data within the compromised files.

Albemarle County discovered on July 15, 2025, that the protected health information (PHI) connected to the county's self-insured health plan was victim to the attack. The self-insured plan supports current and past local government and public school employees, as well as their dependents.

It was found that no medical charts or personal health details were exposed, unless they were stated for insurance to cover the cost.

PREVIOUSLY: Albemarle hit by ransomware attack, employee data at risk

As the investigation continued, it was determined that the compromised data pertained to the people enrolled in the county's self-insured health plan may include, "full names, addresses, phone numbers, emails, social security numbers, dates of birth, employee and user ID numbers, health care ID numbers, account/patient ID numbers, health details related to the payment of care received, invoice numbers for medical care received, the names of medical providers, the dates of medical services, billing and claim information, and health insurance information including subscriber, beneficiary, policy, member and group numbers."

It was also found that any personal identification of current and former local government and public school employees and their dependents, county residents, anyone who has done business with the county and anyone who applied for or received services from the county was also compromised.

The information regarding those may include "names, addresses, driver’s license numbers, Social Security numbers, passport numbers, military ID numbers and state ID card numbers." However, not every piece of information was affected for each individual.

“No organization is immune to today’s cyber threats. We had response plans and insurance in place to limit the impact of this incident. Since the attack, we completed a comprehensive review of our systems, strengthened cybersecurity safeguards, and will continue to evaluate and enhance our defenses based on expert guidance,” said Chief Operations Officer Kristy Shifflett. “While cyberattacks are an unfortunate and increasing reality for public sector institutions, we are treating this as an opportunity to strengthen our systems and enhance our long-term resilience.”

Albemarle County has offered credit monitoring, fraud consultation and identity restoration services to those who have been victimized. Details on how to enroll and a resource guide on ways to protect personal information can be found here.

The deadline to register for the service is March 17, 2026.