Florida health department data captured in cyberattack, hackers claim

TALLAHASSEE — A hacker group claims it has breached the Florida Department of Health and gained access to a large amount of potentially sensitive data on Floridians.

The RansomHub ransomware group said in a post on the dark web that it will release 100 gigabytes of department data unless the state pays an undisclosed amount of money. A database of all of the state’s payments to contractors in a year takes up about 0.1 gigabytes.)

What type of information the group possesses, or even whether it possesses any, is unclear. A spokesperson for the department, which reports to Gov. Ron DeSantis, confirmed on Wednesday the department experienced “a potential cyber incident.” The Times/Herald has asked the state about the hack since Friday.

The Department of Health holds some of the state’s most sensitive information, including individuals’ COVID-19 vaccine records, prescriptions for controlled substances and medical marijuana patient data.

The hacking group, which hit the Christie’s auction house earlier this year, is giving the state until Friday to pay to recover the data, according to its site on the dark web. The dark web is a subset of the internet used by people and groups to hide their locations and identities.

Florida’s government has a policy of not paying ransomware.

Department of Health Press Secretary Jae Williams would only confirm that the attack affected the state’s online Vital Statistics system, used to issue birth and death certificates.

The Times/Herald reported Tuesday that state tax collectors’ offices and funeral homes have been unable to issue birth and death certificates since last week, when the Department of Health’s online system went down.

The issue has added stress for family members needing to bury or cremate loved ones and for residents trying to get official documents to complete applications and forms. But as of Wednesday, at least two Pasco County health offices regained the ability to print birth and death certificates, said Mike Fasano, the Pasco tax collector.

“The Department is coordinating with law enforcement and all relevant stakeholders,” Williams said in a statement, adding that any affected parties will be notified “as a comprehensive assessment of the situation is completed.”

While state and local governments across the country have struggled to combat a growing number of ransomware attacks, Florida’s state government has had unique problems.

After DeSantis created a new cybersecurity agency for state government, he appointed a former state lawmaker with no training on the subject to lead it.

The hire led to a wave of the state’s top cybersecurity experts quitting. Today, Florida is one of the only states in the nation without a chief information officer.

In the last three years, information on more than 10 million Floridians — equivalent to nearly half of the state’s population — has been exposed to hackers during breaches at state agencies, according to annual reports filed by the attorney general’s office.

The reports do not say which state agencies were struck. But in many cases, the state paid for credit monitoring services for Floridians whose personal information was released. In some cases, the exposed information included Social Security numbers, driver’s license numbers and dates of birth.

The Florida Department of Health oversees the state’s 67 county health departments and licenses doctors, nurses and dozens of other health-related professions.

The department is led by Surgeon General Joseph Ladapo, who has championed DeSantis’ anti-COVID-19 vaccine efforts and was condemned by public health officials this year for telling parents it was OK to send unvaccinated kids to school during a measles outbreak.

Times staff writer Christopher Spata contributed to this report.