1. Florida Politics
  2. /
  3. The Buzz

Ransomware attacks put Florida governments on alert

Significant ransom payouts following attacks in Riviera Beach and Lake City highlight the concern of ransomware attacks on local government.
[AP Photo | John Minchillo]
Published Jun. 28

The thought keeps Harold Schomaker up at night: getting hacked.

Schomaker, Largo’s information technology director and chief information officer, says the government for his bedroom community of about 85,000 people follows best practices for cybersecurity.

But recent news that the Florida cities of Riviera Beach and Lake City were so paralyzed by ransomware attacks that they paid a combined $1 million plus to their attackers can’t help but unsettle him.

“It’s my biggest fear,” Schomaker said, adding that his city gets non-stop cyber threats. “Most of the time, you don’t even know it’s happened until after it has happened.”

The recent cyber attacks on Riviera Beach and Lake City knocked out email, phone service and data on the cities’ systems.

News of those attacks came only weeks after the announcement of a ransomware attack on Baltimore. While that port city refused to pay a ransom to its attackers, officials say it will cost more than $18 million as it rebuilds Baltimore’s systems. according to news reports.

Assaults on government agencies using ransomware, a type of malware designed to extort money or other payoff by blocking systems or making changes to a victim’s computer, are not new. But experts say such attacks have increased in frequency in recent years.

At least 170 U.S. state and local governments have publicly acknowledged ransomware intrusions since 2013, according to a report by Recorded Future, a cyber security firm near Boston. And that’s likely only a fraction of the total attacks, that report noted.

That means government organizations — from tiny Belleair Bluffs to larger municipalities like the city of St. Petersburg — are well aware of the threats hackers pose.

“Ransomware is a growing trend right now because (hackers) saw potential,” said Miloslava Plachkinova, interim director of the University of Tampa’s cybersecurity program. She said cyber criminals “saw organizations and governments were not doing enough to protect themselves.”

It can be hard to stop an attack, Plachkinova said. But best practices like routine backups, segmented networks and training employees to be wary of clicking unfamiliar links can deter attacks and mitigate problems if they succeed.

Allan Liska, an intelligence analyst with Recorded Future, said ransomware attackers tend to be opportunists, looking for weak systems.

He said that tends to be smaller or mid-size towns that “don’t necessarily have the money to put the protections in place to keep the bad guys out.”

Liska said he’s had many conversations with IT employees or others “on the front line in these towns.” He said many have put in appeals for years to get protections in place but funding requests have been ignored or delayed.

The city of Tampa is “very confident” in its “active” cyber security program, said communications director Ashley Bauman. She declined to discuss details.

Across the bay, St. Petersburg faces perpetual threats but has security protocols to limit risk, said Brian Campbell, the city’s chief information security officer. He said the city hasn’t faced any system-wide ransomware breaches, although he said there was a breach on a single person’s laptop three to four years ago.

Chris Arbutine, mayor of the tiny Belleair Bluffs (pop: 2,000), didn’t specify cyber security measures taken, referring questions to the city’s IT company, which did not respond. Arbutine said many of his city’s services — such as police and fire — are outsourced, so an attack on his city wouldn’t hurt some of the vital functions.

In Riviera Beach, which has 35,000 residents, the hackers apparently got into the city’s system when an employee clicked an email link that uploaded malware.

The South Florida city agreed to pay $600,000 in ransom.

Lake City — a small community roughly 60 miles west of Jacksonville — said Tuesday that it paid roughly $460,000 in bitcoin to hackers. Paying the ransom was the most cost-effective solution for the city, said city manager Joe Helfenberger.

“We had data from the beginning of when the city was operating until now,” Helfenberger said, adding that much of it would be lost.

There’s debate about whether ransomware victims should pay their attackers. An FBI guidance document for chief information officers says that the U.S. government “does not encourage paying a ransom to criminal actors,” saying that doing so could “inadvertently encourage this criminal business model” and noting that paying does not guarantee that the organization will regain access to their data or not be targeted again.

But the FBI and others also say victims should consider how feasible it is to restart systems without paying the ransom.

“Paying the ransom may be the only possible way to get a functioning system back,” said Nathan Fisk, assistant professor of cyber security education at the University of South Florida. He said the ransom may be considerably less than the damage from an attack.

Lake City had insurance but it did not cover recreation of data, so it opted to pay a $10,000 deductible and let insurance cover the rest. Riviera Beach also used insurance to cover most of the ransom.

The bottom line, experts say: beef up systems now and pay attention to best practices.

“This is not something unexpected. This is not new,” said Kurt Baumgartner, principal security researcher with cyber security firm Kaspersky. “This is something that people need to pay attention to.”

The Associated Press contributed to this report.


  1. Tampa City Council member Orlando Gudes has another $500,000 for an East Tampa cultural center, courtesy of the Hillsborough County Commission. OCTAVIO JONES  |  Octavio Jones
    The Hillsborough County Commission voted unanimously to give the money for the planned facility at Al Barnes Park.
  2. Sen. Rick Scott, R-Fla.
    Scott renews his talking point in the wake of an investigative story.
  3. Democratic presidential candidate Sen. Elizabeth Warren speaks at the Polk County Democrats Steak Fry, Saturday, Sept. 21, 2019, in Des Moines, Iowa. (AP Photo/Charlie Neibergall) CHARLIE NEIBERGALL  |  AP
    All the candidates are here, hoping to pass the Hawkeye test. So far, Elizabeth Warren is surging.
  4. Tallahassee Mayor and Florida gubernatorial candidate Andrew Gillum talks with reporters before addressing a group of gay and lesbian Democrats in Tallahassee on Aug. 19. (AP Photo/Brendan Farrington)
    Gillum accused Florida’s Republican governor of “routine” voter suppression.
  5. Florida Gov. Ron DeSantis talks to reporters in Tampa on Aug. 21. Delays in his filling vacancies on the state's five water management district boards have twice led to those agencies canceling meetings to levy taxes and set budgets, which one expert said was unprecedented. OCTAVIO JONES   |   TIMES  |  Times
    Vacancies lead to canceling two agencies’ budget meetings.
  6. Vice President Mike Pence reacts during an immigration and naturalization ceremony in the Eisenhower Executive Office Building on the White House grounds, Tuesday, Sept. 17, 2019, in Washington. (AP Photo/Alex Brandon) ALEX BRANDON  |  AP
    Katie Waldman, a former University of Florida student senator, was accused of helping discard independent student newspapers with a front-page endorsement of a rival party’s candidate. | Analysis
  7. Richard Swearingen, Florida's Commissioner of the Department of Law Enforcement, testifies before state lawmakers on Monday. Florida Channel
    But law enforcement officials are getting behind a “threat assessment system.”
  8. Rep. Geraldine Thompson, D-Orlando, urges the Florida Board of Education to hold schools accountable for teaching the Holocaust and African-American history, as required by lawmakers in 1994. The board was considering a rule on the matter at its Sept. 20, 2019, meeting in Jacksonville. The Florida Channel
    School districts will have to report how they are providing the instruction required in Florida law.
  9. The Mar-a-Lago Resort in Palm Beach. JOE RAEDLE  |  Getty Images
    It wasn’t immediately clear how much Mar-a-Lago would charge to host the Marine Corps Birthday Ball — or even if it might do so for free.
  10. In this March 24, 2018, file photo, crowds of people participate in the March for Our Lives rally in support of gun control in San Francisco. JOSH EDELSON  |  AP
    ‘Guns are always a volatile topic in the halls of the legislature,’ one Republican said.