Some of the state of Florida’s most sensitive records may now be in the hands of cybercriminals.
The group says it will release 100 gigabytes of data from the Florida Department of Health (F-DOH) unless the state pays.
The city of Jacksonville Beach, Ascension Health Care System and the Florida Department of Health all have one thing in common: They’ve been hacked by cybercriminals who are holding the stolen data for ransom.
The I-TEAM has learned that F-DOH vital statistics information was targeted in the latest breach.
Scott Shoberg, a cybersecurity expert and CEO of Berkeley Varitronics, explains that medical and health information in general is a common target for hackers.
“They know when there’s a wealth of data, and what do we mean by that? Any kind of medical records. They’re extremely rich in personal identifiers. It could be your COVID test, it could be prescription medications that you’re taking. All of those codes and things can be used to misrepresent to insurance companies and bill them for a lot of money. And it’s hard for insurance companies to catch up,” Shoberg said.
The Department of Health has only confirmed that the attack affected the vital statistics system used to issue birth and death certificates. According to the Miami Herald, it also impacted state tax offices and funeral homes that regularly need to access the system.
The Florida Department of Health is responsible for overseeing the 67 health departments, licensed physicians, nurses and other health-related professions.
“There was obviously a vulnerability weakness that was exploited. But guess what, most government systems, I don’t want to say all of them, but most of them, have some number of vulnerabilities,” Shoberg said. “In the cybersecurity world, they have to get it right every time. But think about it from a cybercriminal’s perspective. All they have to do is get it right one time. It may have started as an innocent phishing attack. Somebody, maybe in a hospital or one of the government employees, clicked on something and said, ‘Oh, what’s that?’ And didn’t realize it was a redirect. Now they download a piece of malware, a particular piece of malware, which is usually ransomware.”
News4JAX asked residents about the hack and what they think about state government’s responsibility to protect Floridians’ most personal information.
“It’s unfortunately an open goal, the government needs to step up and get a little bit more funding for cybersecurity, it’s super important, and unfortunately underutilized,” Briee Hansen said.
David Lara said: “I want to be careful here because I’ve worked in other governments and you’re always under-resourced and you’re competing with the private sector for human capital. There’s a lot of issues that come into play, there’s a lot of technology that’s changing very quickly with AI, ransomware and so many other things.”
“It’s terrifying that all these companies have access to our information and can be hacked at any time, it’s terrible to hear,” Jordan Dzialoski said. She also said she believes everyone’s personal information is on the internet and there’s no way around it.
Shoberg says that under no circumstances, even in doctor’s offices, should people give out their full Social Security number.
“But I always tell people to stop before they just fill out that information. Too many of us give out information and say, ‘Well, I trust my doctor.’ Of course I do. But all the other people in the queue, you don’t know them? Or are they selling this information? We don’t know. They say they don’t know. But a lot of information is stolen. So be very careful.”
According to an annual report filed by the Florida Attorney General’s Office, the data of more than 10 million Floridians has been exposed as a result of a hack at a state agency in the past three years.
It should not be forgotten that private companies have also been victims of cyberattacks. Among the most well-known in recent months are Ticketmaster, AT&T and Truist.
Meanwhile, one funeral director we spoke with says they have to go to the health care provider to get a signed copy of a death certificate in order to conduct a burial because the state’s online system is currently down.
Copyright 2024 by WJXT News4JAX – All rights reserved.
