LockBit group targeted Washington County Sheriff’s Office, leaked stolen data

The Washington County Sheriff’s Office in northeastern Florida suffered a cyber attack that affected its finance system and jail networks.

According to local news agencies, the County Sheriff’s Office worked with the WCSO Information Technology team and external cyber security experts to understand the nature and scope of the cyber attack.

“We believe the attack originated in Russia. We aren’t absolutely sure but we believe it to be. We are grateful our communication lines never went down. We never lost our phone lines and were able to continue to serve our community in that arena,” Sheriff Kevin Crews said.

While internal communication wasn’t affected, the department took its official app offline from February 21 until early March. The cyber attack also affected its finance system and jail networks.

The notorious LockBit ransomware gang claimed responsibility for the cyber attack on the Washington County Sheriff’s Office and on February 27, listed the office as a victim on its data leak site. The gang threatened to publish all stolen data from the Sheriff’s Office by March 20 unless its ransom demands were met.

While Sheriff Crews did not specify the amount LockBit demanded, he clarified that the department won’t pay a ransom as law in Florida does not allow any government organisations to pay ransoms related to cyber attacks. “I will not be meeting any of the demands, so what they want doesn’t matter,” Sheriff Crews told local media.

After removing the sheriff’s office briefly from its data leak site, the LockBit group published the compromised data on March 28. According to reports, the leaked data includes warrants and sensitive information on the department’s employees.

When asked by security experts at Databreaches.net about any correspondence to support the decision of not paying the ransom, the Sheriff’s office said that “no written or electronic correspondence exists” and that the department has paid less than $20,000 for IT and database recovery services.