Data stolen from Washington County Sheriff’s Office leaked by LockBit

The LockBit ransomware group, which continues to be the most prolific ransomware group currently operating, accounting for more than half of all ransomware attacks in February, has leaked data it stole from Washington County Sheriff’s Office in northeastern Florida in a ransomware attack, which is believed to have originated in Russia.

According to cybersecurity experts, the leaked data included warrants and employee information. A spokesperson for the sheriff’s office said it recovered from the ransomware attack about two weeks ago. Due to the attack, the department’s app was offline from February 21 until early March, which took down their finance system and jail networks. They hired a private IT company to help with the recovery effort.

LockBit took credit for the attack on February 27 and threatened to leak the data by March 20. The group briefly removed the sheriff’s office before reposting it on Tuesday, leaking all the data it stole. When the attack was first announced, the sheriff’s office said that it would not be paying any ransom since Florida laws prohibit government organizations from paying ransoms connected to ransomware attacks.

Meanwhile, cybersecurity experts filed a public records request with the sheriff’s office to confirm that no ransom was paid, but the department responded that there was “no written or electronic correspondence” related to the ransom discussion. The sheriff’s office said it spent less than $20,000 on IT and database recovery services.