Florida Department of Health Notifies Individuals Affected by June 2024 Cyberattack
The Florida Department of Health has started notifying the individuals affected by its June 2024 cyberattack and has confirmed that the attack was detected on June 26, 2023, and involved the exfiltration of sensitive data from a limited number of its systems.
A forensic investigation was launched into the attack which confirmed that the unauthorized activity occurred on June 26, 2024. The affected files have been reviewed and it has been confirmed that the stolen data included names, dates of birth, addresses, Social Security Numbers, banking information, credit card information, driver’s license numbers, passport numbers, military identification numbers, Nexus numbers, medical and dental histories, medication/prescription information, provider/doctor/care coordinator names, insurance claim information, insurance coverage information, and passwords. The types of data involved varied from individual to individual and the notifications state the exact types of information involved for each individual.
The Department of Health said the affected networks were immediately shut down when the breach was detected and servers were isolated. The cyberattack was reported to law enforcement and the incident was referred to the Florida Department of Law Enforcement for investigation. Since the attack, additional security measures have been implemented to better protect against future attacks.
The Florida Department of Health has arranged for the affected individuals to be provided with complimentary credit monitoring and identity theft protection services for 12 months, which include credit monitoring, web monitoring, fraud consultation, identity theft restoration services, and $1 million identity fraud loss reimbursement.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
As previously reported, the RansomHub ransomware group claimed responsibility for the attack and leaked 100GB of the stolen data when the ransom was not paid. The Florida Department of Health has reported the HIPAA compliance breach to the Department of Health and Human Services’ Office of Civil Rights (OCR) as affecting 729,699 individuals.
July 9, 2024: RansomHub Claims to Have Stolen and Leaked 100 GB of Florida Department of Health Data
The Florida Department of Health has confirmed to FOX 35 in Orlando that it is investigating a cyberattack. The attack has affected its Vital Statistics System, which is used to process birth and death certificates. The disruption to the system has been causing problems for funeral homes across the state for the past two weeks. Some funeral homes have postponed their services or have been forced to physically visit healthcare providers to get signed copies of death certificates.
The Department of Health has released few details about the attack but this appears to have been a ransomware attack involving the exfiltration of a large volume of data. The RansomHub group claimed responsibility for the attack and said it had stolen around 100 gigabytes of data from the Department and started to leak the stolen data when the ransom was not paid by its deadline of July 1, 2024. The Department of Health has not commented on the validity of the group’s claims nor the extent of any data breach.
The failure to pay the ransom should not have come as a surprise, as Florida amended its State Cybersecurity Act to prohibit state agencies, counties, and municipalities that experience a ransomware attack from paying or otherwise complying with a ransom demand. The ban on ransom payments took effect on July 1, 2022.
There are no reasons to believe that the hacking group’s data theft claims are not genuine. RansomHub has conducted many attacks in the United States, including attacks on healthcare organizations and government departments. The group was also indirectly involved in the February ransomware attack on Change Healthcare, having obtained the data stolen in the attack from a BlackCat ransomware group affiliate after BlackCat performed an exit scam, pocketed the $22 million ransom, and refused to pay the affiliate.
