Analyst assessment
A cyberattack disrupted the Florida Department of Health’s online Vital Statistics system in late June 2024, affecting birth- and death-certificate workflows statewide. The department’s August 21 public notice confirmed June 26 unauthorized activity, network access and data transfer from a limited part of its environment. It described shutting down affected networks and isolating compromised servers.
WFSU’s reporting carried by WUSF said the department confirmed ransomware involving the Vital Statistics system. Cyber involvement and disruption are confirmed. The department’s formal notice did not name the responsible operator or establish the initial access method or encryption details.
Operational significance
Local 10’s July 3 report described an inaccessible system since the preceding Thursday, June 27. The agency acknowledged outages following a potential cyber incident and said most department services remained operational. This was a major vital-records disruption rather than a shutdown of every Florida health service.
Funeral homes lost the electronic workflow linking providers, health officials and certificate issuance. Staff had to obtain signatures in person and submit paperwork manually. Delayed death certificates complicated funeral arrangements, cremations and families’ insurance, estate and financial matters. Those effects do not establish a cyberattack on the funeral homes themselves.
A July 11 practitioner memorandum reproduced by the Florida Medical Association said the electronic death-registration system remained down, requested prompt handwritten signatures and described funeral-home backlogs. The memo’s discussion of paperwork requirements explains the operational consequences; it is distinct from evidence that all services stopped.
In WWSB’s report published July 20, Gendron Funeral & Cremation Services still described the registry as unavailable and staff spending extended hours seeking signatures. Some families had completed the process after weeks of delay. Completion of individual certificates did not demonstrate restoration of the statewide electronic system.
June 26 is the department’s confirmed activity and discovery date; June 27 is the visible outage onset reported by Local 10. A native claim record was discovered July 2, while the department’s first verified media acknowledgment in the reviewed original reporting was July 3. The August notice concerns later notification and data findings, not a new outage.
The incident is presumed resolved based on its historical age and the absence of later concrete impairment in the reviewed evidence. July 20 reporting establishes continuing impairment at that point, without an exact interview time. No exact full-restoration date is established.
Confidence and uncertainty
The August notice confirmed unauthorized access to personal and protected health information and transfer of data. The potential information varied by individual and included identity, financial, insurance and medical categories. The department sent individualized letters and offered identity-protection services. Early statements that compromise had not yet been established do not supersede these later findings.
The HHS Office for Civil Rights breach database lists 729,699 people affected in a report submitted Aug. 23, 2024. Its description identifies personal and health information and says the department notified affected individuals and added safeguards. The submission date does not establish when services were restored.
An existing ransomware.live record names floridahealth.gov in a RansomHub claim. The service recorded discovery July 2, 2024; that is not a verified original posting or intrusion date. The claim remains separate from the department’s confirmed data transfer. News4JAX’s July 10 report repeated the gang’s allegation that data had been released after a payment deadline; that report does not independently verify the dataset or payment.
Analytic gaps
The initial access method, encryption details and exact restoration date remain unverified. The primary notice does not verify a particular leak-site dataset, its volume, a ransom amount, payment or operator responsibility.
