JACKSONVILLE BEACH, Fla. – A Global Threat Analyst has a blunt message for people living in Jacksonville Beach. He said, “assume your information is in the hands of cybercriminals.” The city of Jacksonville Beach was hacked at the end of January, and we’ve since learned a Russian-based cybergang called LOCKBIT is responsible.
The incident could impact up to 50,000 people -- their social security numbers and other personal data could be compromised. LOCKBIT is a well-known group of sophisticated cyberthieves and they listed local residents’ personal information on their site on February 12, before being broken up by an International Police Operation.
Brett Callow is a Global Cybersecurity Threat Analyst who works with Emsisoft in British Columbia. It’s been able to help some organizations recover their data without paying a ransom.
Callow sent News4JAX a notification posted by LOCKBIT shortly after the data breach, which gave Jacksonville Beach city officials a deadline of February 26 to pay a ransom. If they didn’t pay, they threatened to make the stolen information public. It’s illegal to pay a ransom in the state of Florida, and the city of Jacksonville Beach did not pay.
On February 12, Callow says the cybercriminals listed the local residents’ personal information they stole on the dark web. Callow says LOCKBIT is based in Russia, where the government there turns a blind eye to these types of criminal activities.
But on February 20, Global Police based in England infiltrated the ransomware criminals’ network, that has extracted more than $120 million from thousands of victims around the world.
Callow says the city of Jacksonville Beach may never know where it’s citizens personal information ended up.
“There is a question of whether other copies were made, where else those copies may be, how many other people have access to that information, and what they may choose to do with it at some future point. So this may never totally be resolved,” Callow said.
Shortly after breaking up the criminal empire, Britain’s National Crime agency gained control of LOCKBIT’s website, posting this message saying, “This site is now under the control of law enforcement.”
“The forensic work that’s needed to uncover that information can take months, sometimes it’s a very very long process. And sometimes it’s simply not possible to work out what was taken. Organizations never know,” Callow said.
City officials say individuals who believe they are potentially impacted by the incident or have additional questions are urged to call a hotline number they set up at 844-709-0703. Consumers have the right to place an initial or extended fraud alert on their credit file at no cost or place a credit freeze on their report.