Karlapalem: Nurses Who Protect Us Deserve Protection, Too, After Board of Nursing Ransomware Attack
From the Karlapalem campaign
Nominee, a small technology business owner with knowledge of cybersecurity and information systems, calls for direct notice, free credit monitoring, a public accounting, renewal protection, and a security review of state licensing agencies
MADISON, Ala. - Hanu Karlapalem, Democratic nominee for Alabama State House District 4, today called for stronger protections for Alabama nurses after the Alabama Board of Nursing announced that a ransomware attack on its systems may have exposed personal and medical information of nurses, license applicants, and members of the public. The Board covers more than 97,000 licensed nurses, according to its website.
"Nurses care for us on our hardest days," Karlapalem said. "They should not have to worry that their Social Security numbers, driver's license numbers, or medical information are in the hands of criminals because of a breach at a state agency. As a small technology business owner with knowledge of cybersecurity and information systems, I know how hard it is to defend against ransomware. I also know that what happens in the weeks after a breach matters as much as the attack itself. I once held a state license myself, so I know how much sensitive information these agencies keep on the people they license."
According to the Board's public notices, investigators identified suspicious activity in its systems in August and confirmed malicious activity on September 1. The Board posted notices in September that a cybersecurity event had disrupted its services, without describing the scope.
On October 2, it said for the first time that some data was collected and downloaded.
The Board said a forensic investigation identified malicious activity within portions of its technology environment. Because of the ransomware deployment, it said, investigators could not establish definitively whether every person's information was fully accessed, but it has reason to believe that sensitive personal and protected health information may have been exposed. That information could include names, dates of birth, Social Security numbers, driver's license numbers, professional licensing information, and medical information. The Board has not said how many people are affected. It is working with the Alabama Office of Information Technology, the FBI, and the Alabama Law Enforcement Agency.
The Board has advised people to watch for phishing and impersonation attempts, change passwords, turn on multifactor authentication, and consider credit freezes or fraud alerts. It has not announced that it is paying for credit monitoring. Its website says it is not currently accepting paper RN renewal applications and will share more about 2026 RN renewal as it recovers. The RN renewal period closes December 31.
A nurse who wrote to state legislators about the breach said nurses need more help. "As frontline healthcare providers, we expect the same level of consumer protection and state advocacy that would undoubtedly be mobilized if a data breach compromised the personal information of physicians, attorneys, or legislators," said Dana Holladay-Hollifield, BSN, RN, NCSN. She said she and her colleagues have begun receiving targeted spam calls and possible phishing attempts.
The Board has separately warned that scammers have impersonated its staff for quite some time, and says there is no indication that activity is related to the cybersecurity incident. It says no Board employee will demand immediate payment or tell a nurse to keep an investigation secret, and that a real investigation begins with a written Notice of Investigation. Nurses who are contacted should note the caller's information, not pay or share personal information, and email abn@abn.alabama.gov.
WHAT KARLAPALEM IS CALLING FOR
• Direct notice. Every nurse, applicant, and other person who may be affected should be told directly and promptly, not only through a website notice.
• Free credit monitoring and identity protection. The state should pay for it. The Board has so far only suggested that people consider outside providers.
• A public accounting. Once the investigation allows, the public should learn what was taken and how many people were affected.
• Renewal protection. No nurse should lose the ability to work because a state agency's systems were down. The Board should publish clear renewal guidance now and make sure no license lapses while its systems are being restored.
• A cybersecurity review of state licensing agencies. Alabama should find and fix weaknesses, including multifactor authentication, vendor oversight, and clear deadlines for notifying the public, before the next breach, not after it.
"Nurses didn't lose this data. It was taken from a state agency's systems," Karlapalem said. "Now they're being told to protect themselves, on top of rent, groceries and child care costs that already don't add up. Paying for credit monitoring and dark web alerts shouldn't fall on the people this breach put at risk. That's what An Alabama We Can Afford means."
"Nurses are a big part of what real healthcare means in this state. They deserve answers now." Karlapalem said.
Nurses and applicants with questions about the incident can contact the Board at cybersecurityevent@abn.alabama.gov.
Hanu Karlapalem is a Madison, Alabama resident of 26 years, small technology business owner, UAH M.S. graduate, Life Member and former Second Vice President of the Limestone County NAACP and Chairman, AANHPI Caucus. He has been married for 31 years and has deep roots in the North Alabama community through civic, professional, and community service. Karlapalemis the Democratic nominee for Alabama State House District 4 in the November 3, 2026, general election.
For more information: https://www.hanu4alabama.com.
