Adrian Fontes on hacking of website, cybersecurity measures

Iranian hackers are presumed to have infiltrated the Arizona Secretary of State’s website in June 2025 and swapped out candidate photos for those of the late Ayatollah Ruhollah Khomeini. The Secretary’s office called it a “very sophisticated attack.” Officials said the photos were taken down immediately after they were discovered.

Adrian Fontes (D), Arizona’s Secretary of State, joined “Arizona Horizon” to address voter concerns over the hack and to explain his plans to address cybersecurity needs going forward.

On June 23, 2025, Secretary Fontes’ office detected an infiltration of an older access system, and while they were able to limit the hack from going further, it led to the defacing of some pages on the website.

“A package of malicious software was placed in, and we detected it, we sequestered it,” Secretary Fontes said. “But it worked its way through to defacing the candidate page that shows results.”

The candidate portal has now been modified to block future attempts. Secretary Fontes also emphasized other aspects of the website were not affected, such as the statewide voter registration database, the confidentiality program to protect victims of domestic violence and the E-Qual system, where candidates can collect signatures and receive seed money to qualify for public campaign finance.

“Nowhere where there was significant amounts of personal identification information was attacked,” Secretary Fontes said.

He added while the hack was stopped, dangers still exist for the systems the Secretary of State’s office uses due to how many of them are out-dated and in need of a complete overhaul.

“The big problem that we have is the old legacy systems that were written in languages that almost no engineers know how to use anymore,” Secretary Fontes said. “These legacy systems have to be replaced. We can’t just go in and fix them because many of the software companies that used to support them don’t even exist anymore.”

Secretary Fontes’ office alerted federal officials when they discovered the breach. Notably absent from the list of contacts was the federal Cybersecurity and Infrastructure Security Agency (CISA), as Secretary Fontes said the agency had become uncommunicative since the start of the new administration.

“We don’t have any of the support services that CISA and the Department of Homeland Security used to provide for us, and we can’t talk to them,” Secretary Fontes said. “The new administration will not support election security anymore, and that’s really problematic and one of the reasons why this issue is really scary.”