Florida Department of Health victim of a “potential cyber incident”

Florida Department of Health victim of a “potential cyber incident”

TAMPA, Fla. – The organization known as RansomHub has claimed responsibility for a cyberattack on the Florida Department of Health, according to a prominent cybersecurity firm.

When asked about the group’s claim, the Florida Department of Health confirmed that a “potential cyber incident” had caused an outage in the state’s vital statistics system, causing significant problems for funeral homes in the state.

In a statement, government officials said the Department of Health was “coordinating its response to the incident with law enforcement and all relevant stakeholders.”

What you need to know

  • According to cybersecurity firm HackManac, the RansomHub group has claimed responsibility for a cyberattack on the Florida Department of Health
  • In similar attacks on large companies, victims sometimes have to pay ransoms amounting to millions.
  • However, in Florida, it is illegal for a government agency to pay a ransom or meet demands following a cyberattack.

Will Hawkins, owner of Enterprise Data Solutions, Inc., works with more than 600 companies, guiding them through data protection, data recovery and cybersecurity.

He says companies are sometimes forced to pay ransoms, and if they don’t, the data can leak online, which can cost a company tens of millions of dollars and even bring operations to a halt.

He said companies should not give in to their demands or pay a ransom in the event of an attack.

“First, there is no guarantee you will get your data back,” Hawkins said. “Second, you are paying a criminal organization, giving them a reason to keep doing what they are doing. You are funding their future operations. Third, you may be paying a banned organization. It could be a state actor, it could be a gang in North Korea or Iran.”

In Florida, state law prohibits state, local or county agencies from paying a ransom or meeting the demands of the perpetrator of a cyberattack.

According to cybersecurity firm HackManac, which tracks cyberattacks around the globe, RansomHub claimed to have “exfiltrated” 100GB of data from the Florida Department of Health and gave the department a July 5 deadline to pay the ransom.

That deadline has since passed, but the Florida Department of Health’s statement did not specifically address the potential sharing of data collected as a result of the attack.

However, it said: “All affected parties will be notified once a comprehensive assessment of the situation has been completed.”

Hack leads to delays in death certificates and cremations

Stephanie Lawson, director of Lawson Funeral Home, said the system outage caused weeks of delays.

“Our funeral home, doctors and coroner are all trying to work hand in hand, but it’s difficult all around,” Lawson said. “Because everything used to go through the computer to the different departments and we could get cremation permits within 24 to 48 hours. Now it takes longer.”

Funeral directors fear they will have to turn some people away if a solution is not found soon.

“It is very stressful for funeral homes and devastating for surviving family members who must wait during this process to return their deceased family member to their care,” TJ Cohen, director of Cremations of Tampa Bay, said in a statement. “I know it is hard, but we ask families for patience.”

A spokesman for the Florida Department of Health said they are asking health facilities and doctors to help “expedite the issuance of handwritten death certificates.”

“We are working around the clock to restore the online vital statistics system,” said Dr. Joseph Ladapo, the state’s surgeon general. “Most of the department’s operations and services remain unchanged and operational.”

The delay has now also affected birth certificates. A spokesman for the Hillsborough County Tax Collector’s Office said that birth certificates have been suspended. Families must contact the health department to obtain a copy.

Hospitals are also changing their business processes. Since the system failed, they have been processing birth and death certificates for families manually, a BayCare spokesman said.

“We are adapting to the disruption of EDRS service and have no capacity issues or concerns at this time,” said Jaye Toler, communications strategist at BayCare. “We will continue to monitor the situation.”