Madison County Youth Court Judge Staci O'Neal's email account was breached after a spam email in 2025

What happened

WLBT reported that Madison County Youth Court Judge Staci O'Neal's county email account was breached on October 15, 2025, after she opened a spam email on her cell phone. County records reviewed by the station show the account was open to intruders for about 33 minutes before IT staff reset the password. During that window, the records show, the mailbox and connected Teams sessions were accessed, and the account held an active case report along with information on other minors in the youth court system. A security firm retained by the county found the account had no enforced multi-factor authentication.

How it started

The entry point was a single spam email opened on a phone. The county records describe logins from New York, New Jersey, and Germany during the breach, and note that some files can be viewed without leaving a clear log, so the full scope of what was read is uncertain. The exposure in this case was case material, not the judge's home address. Even so, the incident shows how much sensitive information sits behind one court login.

What this means for you

Mississippi law already treats a judge's home address as private. Miss. Code Ann. § 25-61-12 exempts the home address, private phone numbers, and other personal details of judges, law enforcement officers, criminal investigators, and district attorneys, along with their spouses and children, from the state Public Records Act. That exemption only governs what state and local agencies release. It does nothing about the people-search and data-broker sites that compile and post the same address from other sources.

In 2025, Mississippi lawmakers introduced two anti-doxxing measures: House Bill 678, the Mississippi Doxxing Prevention Act, which would have created criminal penalties for publishing an official's personal information to threaten or harass them, and Senate Bill 2821, the Law Enforcement Anti-Doxxing Act, which would have expanded the public-records redaction rules. House Bill 678 died in committee; Senate Bill 2821 passed the full Senate but died in a House committee. Neither would have created a New Jersey-style Daniel's Law right to force data brokers to delete a judge's information. Until Mississippi passes a law like that, removing a judge's address from broker pages falls to the judge or their employer.

An account breach and a public home address are two separate exposures, and each one is worth closing. This case turned on email security. The address side is the part that removal work addresses: the fewer places a judge's home address and family details are listed, the less a determined person can pull together from a distance.