The county is recovering from the Easter ransomware attack. Hernando Sun was the only news organization able to locate the ransomware auction of the data and report on it. We were contacted by Threat Analyst Brett Callow for Emsisoft because of our coverage of the County’s IT outage. He had tweeted that Hernando County was the victim of a ransomware attack by the Rhysida ransomware group. Mr. Callow provided us with information on how to find the auction.
At the time that we learned of the auction the county media release stated that they were not aware of any data that was exfiltrated. The Hernando Sun was able to confirm that there was an auction on the dark web and that the ransomware attackers had screenshots of a small portion of the county’s data. This indicates that data was taken in the attack.
The attackers created an auction with a suggested price of 40 bitcoin or $2.8 million that was counting down to early on Thursday, April 18th. If no one purchased the data, the Rhysida ransomware group may attempt to sell or release smaller batches of data that were stolen. They stated that they were selling an exclusive copy of the data.
This uncertainty means that all county residents, employees, and contractors need to be extra vigilant. Check credit card bills to make sure that there are no fraudulent charges. Monitor credit reports to ensure that no one is borrowing money using your information.
Many of the services that were knocked offline by the ransomware attack are back up and running. There does appear to be some gaps in data, which are being rectified. This often happens when backups are used. The backups only supply data to a certain date and will be missing data that was created between the backup and the current time. For instance, the county was missing the marriage information on the clerk’s site. There was a gap in the data from March 28 until April 15 and now that data has been loaded.
Hernando County hired the Clerk’s office to manage its Information Technology (IT). This is why the County Clerk is the main source of information on the outage. Hernando County Clerk Doug Chorvat stated, “I am happy to report that the public-facing systems are now available, except credit card processing.”
