TAMPA, Fla. — According to a well-known cybersecurity firm, the organization known as RansomHub has claimed responsibility for a cyber attack on the Florida Department of Health.
When asked about the group's claim, the Florida Department of Health confirmed that a "potential cyber incident" has caused an outage in the state's vital statistics system — one that has caused significant issues for funeral homes in the state.
State officials said in a statement that the Department of Health "is coordinating with law enforcement and all relevant stakeholders" in response to the incident.
Will Hawkins, owner of Enterprise Data Solutions, Inc., works with more than 600 companies, and guides them through data protection, data recovery, and cyber security.
He says companies are sometimes forced to pay ransom and if they do not, that data can be leaked online. It can cost a company tens of millions of dollars and even bring operations to a standstill.
He said companies are not advised to give into demands or pay a ransom when attacked.
“One, there is no guarantee that you are getting your data back," Hawkins said. "Two, you are paying a criminal organization and giving them a reason to keep doing it. You are funding their future operations. Three, you might be paying a banned organization. It could be a nation-state actor, it could be a gang in North Korea or Iran."
In Florida, state law prohibits state agencies, municipalities or counties from paying a ransom or complying with demands from the perpetrator of a cyber attack.
According to the cybersecurity firm HackManac, which tracks cyber attacks around the globe, RansomHub claimed to have "exfiltrated 100 GB of data" from the Florida Department of Health and gave them a July 5 deadline to pay the ransom.
That deadline has passed, but the statement from the Florida Department of Health did not specifically address the potential leak of data gathered during the attack as a result.
It did say that, "Any effected parties will be notified as a comprehensive assessment of the situation is completed."
Hack leads to delays in death certificates and cremations
Stephanie Lawson, the director of Lawson Funeral Home, said the system failure has caused week-long delays.
“Between our funeral home, the physicians, the medical examiner, we all are trying to work hand in hand, but it’s difficult all the way around,” Lawson said. “Because on the computer everything went to those various departments, and we were able to get those cremation permits in 24 to 48 hours. Now it’s taking longer.”
Funeral homes are worried if there is not a solution soon, they will have to turn some people away.
“It is very stressful for the funeral homes and devastating to the surviving family members who have to wait during this process before they can get their deceased family member back into their care,” said T.J. Cohen, the director of Cremations of Tampa Bay, in a statement. “I know it’s hard, but we ask the families for patience.”
A spokesperson for the Florida Department of Health said they are requesting support from health care facilities and doctors to “expedite hand-signed death certificates.”
“We are working around the clock to restore the online Vital Statistics system,” said State Surgeon General Dr. Joseph Ladapo. “The majority of department operations and services remain operational and unchanged.”
Meanwhile, the delay is also impacting birth certificates. A spokesperson for Hillsborough County’s Tax Collector said they have stopped issuing birth certificates. Families will have to go by the Department of Health to receive a copy.
Hospitals are also changing the way they do business. Since the system went down, a spokesperson for BayCare said they’ve been manually processing birth certificates and death certificates for families.
“We are adapting to the EDRS service interruption and are not currently experiencing any capacity issues or concerns,” said BayCare communications strategist Jaye Toler. “We will continue to monitor the situation.”