Arizona secretary of state seeking new cyber funding after website hack

Arizona Secretary of State Adrian Fontes met with state lawmakers Tuesday to request additional cybersecurity funding, pointing to a recent hack of an online portal operated by his office.

According to a press release from Fontes’ office, the secretary is asking for a one-time allotment of $10 million and $3.5 million in ongoing funding to “modernize and protect” Arizona’s election infrastructure. In a private, bipartisan session with legislators, Fontes reportedly highlighted the defacement last month to a political-candidate portal in which headshots were replaced with images of Ruhollah Khomeini, the late revolutionary and founder of the Islamic Republic of Iran.

“Our defenses held this time—but we can’t rely on outdated systems to protect us forever,” Fontes said in the release. “We need to modernize our infrastructure now, not after something goes wrong.”

According to Fontes’ office, the website was “quickly isolated and secured, thanks to existing cybersecurity protocols and close collaboration with the Arizona Department of Homeland Security,” preventing intrusion into more critical systems. The state’s voter information database and its Address Confidentiality Program — which protects the personal information of victims of domestic violence, sexual offense and stalking — were not affected, according to the release.

In the press release, Fontes’ office called the need for funding “urgent,” and noted that lawmakers of both parties seemed to understand the request.

“Cybersecurity is not a partisan issue—it’s about trust in our democracy,” Fontes said in the release. “We have a duty to ensure our systems remain secure, modern, and resilient—now and for every election to come.”

State support for cybersecurity is especially salient as the federal government scales back programs that state and local governments have long relied upon. The Center for Internet Security’s elections infrastructure information-sharing group lost its funding this year, and the Cybersecurity and Infrastructure Security Agency has eliminated dozens of positions that supported communications with local agencies.