The Ransomware gang that’s taking responsibility for hacking the Florida Department of Health now claims it’s published the stolen data on the dark web. This, after they say the DOH missed a Friday deadline to pay the ransom.
The News4JAX I-TEAM reported last week about the department’s Office of Vital Statistics. That department is unable to process death or birth certificates online and these documents must now be dropped off or picked up in person.
Aaron Clark went to the Florida Dept. of Health on Wednesday to pick up his daughter’s birth certificate.
He says he’s just now learning that personal data like dates of birth and social security numbers were stolen, then published on the dark web by Ransom HUB hackers.
“Everybody is getting hacked, I’m not sure what they’re going to do with the information but I hope they get to the bottom of it,” Clark said.
The Florida Dept. of Health issued this statement about obtaining birth certificates:
County health departments are able to issue copies of birth certificates for individuals born before June 28, 2024. For births after this date, the department is working with the hospitals to continue the manual processing of birth certificates.
When it comes to death certificates, the I-TEAM has obtained internal e-mails sent to funeral homes around the state, giving funeral directors instructions on how to manually fill out death certificates.
- While the online system is down, a health care practitioners’ signature is required alongside the cause of death.
- A Medical examiner will need to approve the cause of death if the disposition is cremation, donation, or burial at sea.
- A funeral director must sign the burial transit permit.
“Whether it be a data loss, whether it be like you mentioned death certificates, birth certificates--we will just have to wait and see what the impact ends up being long term,” Tyler Chancey with Scarlett Cybersecurity said.
Chancey says typically after a hack, the victims determine how much data was stolen, contain the threat, eradicate it, then attempt to recover the data.
He says the recovery times for victims of a cyber event like what the Florida Dept. of Health experienced varies based on how effective the agency’s incident response plan was before the event.
“We’ve seen victims come back online fully from a major cyberattack in 48 hours, we’ve seen it take two months. So it really depends on the preparation work you’ve done,” Chancey said.
Security experts say health insurance information, appointment details, medical record numbers, health policy number and screening results from Floridians may also have been published on the dark web after the attack.
So, cybersecurity experts say if you think you’ve been impacted, it’s important to freeze your credit, change your passwords, and be aware of any changes made to your health or insurance information. Changes could indicate attempts at identity theft.