The city of Pensacola, Florida is notifying an undisclosed number of people that their private information was compromised in a March 2024 data breach.
The impacted data includes first and last names, Social Security numbers, ID card numbers (e.g. driver’s license), passport numbers, military ID numbers, and health insurance policy numbers. An investigation of the incident wrapped up on April 2, 2024.
The attack took down the city’s phone lines and several online services, including bill payment, and the FBI came in to investigate the incident. No cybercriminal groups has taken responsibility for the attack as of time of writing.
The notification (PDF) reads, “On March 16, 2024, a network security incident involving an unauthorized party gaining access to our network environment was discovered. Upon detecting the incident, we immediately shut off all access to the network and engaged a specialized third-party forensic incident response firm to assist with securing the network environment and investigating the extent of unauthorized activity. The City’s network has been secured.”
The compromised data could be used for identity and health benefits fraud. Comparitech advises victims to take advantage of the free credit monitoring offered by the city via TransUnion. Keep an eye on your credit reports, financial accounts, and hospital bills for suspicious activity.
The city declined to answer questions about how many people were affected, how attackers breached its systems, who the attackers were, or whether the city paid a ransom.
A spokesperson for Pensacola told Comparitech in an email, “The remainder of your questions cannot be answered at this time, since it is an ongoing criminal investigation.”
This is Pensacola’s second major cyber attack in the last five years. It suffered a ransomware attack in 2019, after which it offered 60,000 people credit monitoring.
Ransomware attacks on US government organizations
The attack on Pensacola, FL is consistent with many ransomware attacks against local governments. Ransomware gangs frequently target government entities. Attacks on government organizations disrupt key infrastructure and services, such as 911 dispatch centers, sheriff’s offices, city councils, and utilities. Government staff are left without computer systems and have to resort to pen and paper. In some cases, organizations may be able to restore lost data using backups, but in many cases, they are forced to either pay extortionate ransoms or make the costly decision to rebuild their systems from scratch.
Comparitech researchers logged 22 confirmed attacks on US government entities so far in 2024, affecting 49,306 records. We recorded 74 confirmed attacks in 2023, affecting 309,810 records. The average ransom amount in 2023 was $830,000.
We’ve logged a further 11 unconfirmed attacks on US government organizations so far this year, and 34 since we started monitoring unconfirmed attacks in April 2023.
About Pensacola, FL
Pensacola is the westernmost city in the Florida Panhandle. The metropolitan area is home to more than 500,000 residents. The city is governed by an elected mayor and seven-member city council. Pensacola Beach is a major tourist destination.