Cyber-Attack Timeline: ARRL

FAQs on the ARRL Cyber Attack

• 1. What happened in the ARRL cyber attack?

  In May 2024, the American Radio Relay League (ARRL) — the national association for amateur radio in the United States — was hit by a sophisticated ransomware attack that encrypted its systems and disrupted its IT and online services, including email and the Logbook of The World (LoTW). ARRL involved the FBI and external forensic specialists, who described the incident as extensive and categorised it as 'unique', affecting network devices, servers, cloud-based systems and PCs. The attackers, reportedly the Embargo ransomware operation, stole the personal information of around 150 employees, and ARRL ultimately paid a US$1 million ransom to obtain a decryption tool. Recovery took more than a month, making it one of the most disruptive attacks on a US non-profit in 2024.

• 2. When did the ARRL cyber attack take place?

  ARRL has given several closely related dates: a press release referred to a network attack 'on or around 12 May 2024', while the CEO's breach-notification letter said the ransomware incident was detected and stopped 'on or around 14 May 2024', with systems encrypted on the morning of 15 May. ARRL publicly disclosed the incident on 16 May 2024. Its phone system was restored on 31 May, the Logbook of The World returned to service on 1 July, and some systems such as DXCC remained offline into August 2024.

• 3. Who was behind the ARRL cyber attack?

  ARRL did not formally attribute the attack to a specific group, describing it as the work of 'a malicious international cyber group'. However, sources told BleepingComputer that the Embargo ransomware operation was behind the incident. The FBI categorised the attack as 'unique', and ARRL said the threat actors appeared to believe the organisation had extensive insurance coverage that would fund a large ransom.

• 4. Did ARRL pay a ransom in the cyber attack?

  Yes. ARRL confirmed it paid a US$1 million ransom — not to prevent stolen data from being leaked, but to obtain a decryption tool to restore the systems encrypted in the attack. ARRL said the attackers' demands were 'exorbitant' and were weakened by the fact that they did not hold significant compromising data; after tense negotiation, ARRL agreed to the US$1 million figure. The payment and the cost of restoration were largely covered by the organisation's insurance policy.

• 5. What data was stolen in the ARRL breach?

  In a filing with the Office of Maine's Attorney General, ARRL stated that the breach affected around 150 employees. The CEO's notification letter told affected individuals that the impacted data may have contained personal information including their name, address and Social Security number, though ARRL said there was no evidence the information had been misused. Affected individuals were offered 24 months of Kroll identity-monitoring services, including credit monitoring, identity-theft restoration and up to US$1 million in identity-fraud loss reimbursement.

• 6. Was ARRL members' personal data affected?

  ARRL stressed that it does not store credit card information anywhere on its systems and does not collect Social Security numbers for members. It said its member database contains only largely public information such as name, address and call sign, along with ARRL-specific data like email preferences and membership dates. ARRL also repeatedly stated that Logbook of The World (LoTW) and DXCC user data were secure and unaffected. The confirmed data theft related to employee information rather than member records.

• 7. Which ARRL services were affected by the attack?

  The attack disrupted a wide range of ARRL services, including email, the Logbook of The World (LoTW), the ARRL Learning Center, the DXCC award system, telephone services, and parts of the Volunteer Examiner Coordinator (VEC) and Radiosport award processing. The @arrl.net email forwarding service continued running, though aliases could not be modified, and the QST magazine print edition faced minor delays. ARRL kept several systems offline as a precaution even where the underlying data was reported to be secure.

• 8. How long was ARRL down and when did it recover?

  Recovery took more than a month, with a phased restoration of services. ARRL's phone system returned on 31 May 2024, many membership and licensing services resumed through late May and June, and the Logbook of The World came back online on 1 July 2024, taking around four more days to clear the backlog. Some systems, notably the online DXCC application, remained offline into August 2024 while ARRL rebuilt under new infrastructure guidelines and standards.

• 9. How did ARRL respond to the cyber attack?

  ARRL took affected systems offline, secured its network environment, and engaged independent third-party forensic specialists, while involving the FBI and federal law enforcement. It worked under the guidance of cyber-crime attorneys and the authorities, which led it to communicate cautiously and conservatively during the response. ARRL rebuilt affected servers under new infrastructure guidelines and standards, and offered affected individuals 24 months of Kroll identity-monitoring support.

• 10. Did insurance cover the ARRL ransom payment?

  ARRL said the US$1 million ransom payment, together with the cost of restoration, was largely covered by its insurance policy. It also noted that the attackers appeared to assume ARRL held extensive insurance that would fund a multi-million-dollar payment, which shaped their demands. The episode highlighted both the value and the limits of cyber insurance in a ransomware crisis.

• 11. Why was ARRL criticised over its communication?

  Some members felt ARRL should have communicated more openly about the incident as it unfolded. ARRL explained that it was acting on the advice of industry experts, cyber-crime attorneys and the authorities, who directed it to be conservative and cautious with communications while it restored its network. This tension — between transparency and legally guided caution — is common in ransomware response and is a key crisis-communications lesson from the incident.

• 12. What can organisations learn from the ARRL cyber attack?

  The ARRL incident shows that even smaller non-profits with limited resources are targets for sophisticated ransomware, and that recovery can take weeks and disrupt core member services. Key lessons include maintaining tested, offline-capable backups to reduce reliance on attacker decryptors, minimising and protecting sensitive employee data, planning crisis communications in advance, understanding exactly what cyber insurance will and will not cover, and rehearsing the response before a crisis. Cyber Management Alliance helps organisations build these capabilities through training, cyber crisis tabletop exercises and incident response planning.