Some of the state of Florida’s most sensitive records may now be in the hands of cybercriminals.
The group says it’s going to release 100 gigabytes of data from the Florida Department of Health (F-DOH) unless the state pays up.
The city of Jacksonville Beach, The Ascension Health Care System and the Florida Department of Health have all been hacked by cyberthieves who are holding stolen data for ransom.
The I-TEAM learned that F-DOH’s vital statistics information was targeted in the latest breach.
Cybersecurity Expert Scott Schober, the CEO of Berkeley Varitronics, said medical and health information overall has been a common target for hackers.
“They know when there’s richness of data, and what do we mean by that? Any type of health records. They’re extremely rich with personal identifiers. Maybe it’s your COVID test, maybe it’s the prescription medication you’re taking. All of those codes and things can be used to really make false claims to insurance companies and invoice them to get collection of a lot of money. And it’s hard for the insurance companies to catch up with it,” Schober said.
The F-DOH has only confirmed that the attack affected the vital statistics system used to issue birth and death certificates. According to the Miami Herald, that’s also had an impact on tax collector offices and funeral homes in the state, which routinely have to access that system.
The F-DOH is responsible for overseeing all 67 health departments, licensed doctors, nurses and other health-related professions.
“Obviously, there was a weakness or vulnerability that was exploited. But guess what, most government systems, I don’t want to say all of them, but most of them, have a number of vulnerabilities,” Schober said. “From the cybersecurity world, they have to get it right every single time. But think about it from a cybercriminal. All they have to do is get it right once. It may have started with an innocent phishing attack. There’s somebody there, maybe at a hospital or one of the government workers clicked on something and said, ‘Ohb what’s this?’ Not realizing it was a re-direct. Now, it downloads malware, a particular strand, that’s usually ransomware.”
News4JAX asked locals about the hack and what they thought about the responsibility of state government to keep Floridians’ most personal information safe.
”It’s an open target, unfortunately. The government needs to step in and get a little more funding for cybersecurity. It’s super important, and unfortunately underutilized,” Briee Hansen said.
”I want to be careful here because I’ve been in government in other places and you’re always under-resourced and competing with the private sector for human capital,” David Lara said. “There’s a lot of issues that go into that. There’s a lot of technology moving so quickly with AI and ransomware and so many other things.”
”That’s terrifying that all these businesses have our information and can be hacked at any time. That’s awful to hear,” Jordan Dzialoski said.
She also said she thinks everyone’s personal information is on the internet and there’s no way around it.
Schober said under no circumstances, even at doctors’ offices, should people give out their full Social Security numbers.
“But I always tell people, ‘Stop before you just fill that information out.’ Too many of us give away information and while we say, ‘Well, I trust my doctor.’ Sure, I do too. But all the other people in line you don’t know? Or do they sell that information? We don’t know. They say they don’t. But a lot of information is stolen. So really be cautious,” Schober said.
According to an annual report filed by the Florida Attorney General/’s Office, the data of more than 10 million Floridians has been exposed through some kind of hack at a state agency over the past three years.
And don’t forget private companies have also fallen victim to cyberattacks. Some high-profile ones in recent months include Ticketmaster, AT&T and Truist.
In the meantime, a funeral director told News4JAX that they’re having to visit the health care provider to get a signed copy of a death certificate to perform a burial because the state’s online system is currently down.