State lawmakers demand answers from Florida Department of Health after massive data breach

State lawmakers are calling for a thorough investigation into the Florida Department of Health hack after 9 Investigates confirmed Tuesday more than 40,000 files were stolen and leaked on the dark web.

▶ WATCH CHANNEL 9 EYEWITNESS NEWS

Hacker group RansomHub published the files nearly two weeks ago.

They include very sensitive records like HIV test results, doctors’ notes, mammograms, birth certificates, among other files.

9 Investigates spoke to some patients who say they have not been notified by the state.

Read: 9 Investigates confirms stolen Florida patient data published to dark web

Lawmakers we spoke to say this needs to be addressed immediately.

“Complete disappointment and embarrassment for the state of Florida to allow this to happen,” said Rep. Anna Eskamani.

Eskamani says she asked the Department when patients will be notified if their information was compromised but has received little information. She’s now calling for a legislative investigation into the cyber-attack and the department’s handling of it.

“This is a complete failure on many levels, and we owe it to the people of Florida to provide them with a direct response,” Eskamani said.

Read: Florida Department of Health confirms it was targeted by criminal hacking group

The Department released a statement to us last Friday, saying in part that “affected parties” will be notified once the department completes a “comprehensive assessment.”

We asked the department Thursday morning how long that assessment would take and for a timeline for when patients would be notified. But the department said it had no further comment.

“It doesn’t give me confidence that the State Department of Health is going to be notifying these individuals quickly. What is the state going to do to support those individuals that were impacted?,” said State Senator-Elect Carlos Guillermo-Smith. He says notifying Floridians timely is crucial, especially when their information is in the hands of cybercriminals.

Read: Hackers claim massive data heist of Florida Health Department system

“They already tried to blackmail the state of Florida, but how else can this data be weaponized against Floridians. It certainly is a fear that I have,” Smith said.

Smith and Eskamani say they fear with the cyberattack and the Department’s lack of transparency will cause many to hesitate to seek treatment at health departments—or avoid treatment completely. They say the level of privacy and protection you would expect with a healthcare provider has been broken with the Florida Department of Health hack.

Again, the Department did not respond to our questions on Thursday but said last week that they are still trying to understand the extent of this attack.

You can read the DOH’s full statement from July 12 below:

“The Florida Department of Health (Department) is working diligently with law enforcement and all relevant stakeholders in responding to one of multiple attacks perpetrated by criminal hacking organizations against several states in a nationwide and worldwide trend of cybersecurity attacks targeting health care organizations. The majority of Department systems and services remain operational with no disruptions. In an effort to protect the private data of Floridians, certain systems were proactively brought offline to strengthen security measures and bolster monitoring. The Department remains engaged in protecting data as the scope and extent of this attack is fully understood.

Any affected parties will be notified as a comprehensive assessment of the situation is completed. We encourage all FDOH healthcare providers to stay attentive to alerts from the Department and follow those best practices disseminated to secure data.

This incident has also been referred to FDLE for investigation, and criminal activity will be prosecuted to the fullest extent of the law.”

Click here to download our free news, weather and smart TV apps. And click here to stream Channel 9 Eyewitness News live.