Florida Department of Juvenile Justice
Florida Department of Juvenile Justice cyber incident
Summary
A March 2024 cyber incident took Florida’s juvenile case-management systems offline and forced staff to keep records manually. Core JJIS access was subsequently restored, while a state report documented continuing remediation of reporting connections.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Email disruption
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Florida’s Department of Juvenile Justice took systems offline after detecting a potential cyber incident on March 29, 2024. Fresh Take Florida’s April 4 report documented the department’s acknowledgment and continuing loss of access to the Juvenile Justice Information System, which supports statewide case management. March 29 is the known detection and shutdown date; the initial intrusion date remains unknown.
Operational significance
Employees could not retrieve some probation-contact information or upload records for judges and were told to keep case notes offline. Some email functions were also impaired. These were documented interruptions to casework, without evidence that detention facilities closed or all in-person services stopped.
In News Service of Florida’s July 11 report, carried by WUSF, the department said all DJJ-staffed sites had regained JJIS access, while many contractors remained unable to connect and were documenting work on paper. The spokesperson anticipated partner access in the following days; that expectation does not establish when it returned.
The joint DCF/DJJ quarterly report, dated October 2024, confirms the cyber incident and restored JJIS access but says connections needed for joint data analysis were still undergoing remediation when the report was submitted. Core staff access, contractor access and reporting connections were distinct recovery dependencies.
Confidence and uncertainty
Confidence is high in a cyber-related loss of system availability, supported by the department’s statements and joint report. The April account also carried an unnamed employee’s allegations of an infected email and ransom demand. Those allegations do not establish ransomware encryption, a verified entry route, data theft or payment. No responsible group is established.
The department’s budget account describes its protective shutdown and security improvements. Later security work does not by itself establish a continuing outage or a recovery date.
Analytic gaps
The intrusion window, technical mechanism, exposure of sensitive information, affected-user total and complete restoration date remain unestablished. July 11 is the latest precisely dated report of continuing access impairment. The October report describes residual reporting limitations but supplies no exact observation date for them.
Operations are presumed resolved given the elapsed time and documented restoration of core access. The exact end remains unset; neither an anticipated restoration nor the quarterly report’s cover month supplies a final recovery day. The separate Florida Department of Health incident is not merged with this event.
Organizations involved
Impacted locations
Florida
The statewide juvenile case-management system was unavailable. This service-area overlay does not assert that every detention facility or all in-person services closed.
Tallahassee, Florida
Tallahassee is the department’s headquarters anchor for its statewide case-management network. This link does not establish a Tallahassee municipal outage.
Sources
The department confirmed that systems including JJIS were offline after a security concern. Employees used offline case notes and lost access to records and some email functions. An unnamed employee alleged an infected email and ransom demand, without official confirmation.
The department said staff sites had regained JJIS access while contractor access was still pending. Many providers continued paper documentation, and partner access was expected in the following days. The report distinguishes this incident from the separate health-department attack.
The department’s budget narrative describes taking systems offline in response to the cyber incident and subsequent security improvements. It does not establish a precise full restoration day.
The joint report confirms the March 2024 cyber incident and says JJIS access had returned. Connections needed for joint analysis remained under remediation when the report was submitted; the data section was left as a placeholder.
See something that needs correction?
Signed-in members can report an error, update, or missing source.