Ransomware Attack Hits Florida Department of Health

A cyber attack on the Florida Department of Health has reportedly disrupted the state’s ability to issue death and birth certificates, and it might also put sensitive patient data at risk.

In a post on the dark web, ransomware group RansomHub claimed to have stolen 100 gigabytes of data, which it threatened to publish by Friday if not paid, the Tampa Bay Times reported. But Florida law prohibits state and local governments from paying ransomware extortion, and not all cyber criminals keep their promises when paid.

The department confirmed to the Tampa Bay Times that the attack affected its online Vital Statistics system, which handles certificates for births, deaths, divorces, marriages and apostilles.

With that system affected, funeral directors cannot submit death information online, according to News4JAX. Instead, they need to complete death certificates by hand and drive them to health departments for processing. That makes it more difficult for people to get sign-offs needed to bury or cremate a deceased loved one.

“When we take a person to the cemetery, we have to have a burial permit, not necessarily the death certificate completed but we would have had to contact the signing physician for that physician to agree that he will sign the death certificate before that person can be buried in a cemetery or actually be cremated,” McKinney Family Funeral Home Funeral Director Reginald McKinney told News4JAX.

Delays in death certificates also impede families’ abilities to get Social Security, veteran’s or retirement benefits, probate estates or make insurance claims.

The Florida Department of Health includes a central office overseeing statewide health responsibilities, 67 county health departments, eight children’s medical services area offices, 12 medical quality assurance regional offices, nine disability determination regional offices and three public health labs.

This isn’t the first time RansomHub has threatened health-care organizations. It also reared up during the aftermath of the spring 2024 ransomware attack on Change Healthcare. Cyber crime group BlackCat first hit and extorted Change Healthcare, and then — following drama with its affiliates — apparently dissolved. Soon after, RansomHub announced claims that it, too, had access to stolen Change Healthcare data.

*This story originally ran on Government Technology, a sister publication to Industry Insider — Florida.