Cyber Incident Victim: Florida Department of Economic Opportunity
Date:
Apr 2021
Location:
United States of America
Summary
The Florida Department of Economic Opportunity experienced a breach impacting approximately 58,000 accounts within its Reemployment Assistance Claims and Benefits Information System (CONNECT), compromising sensitive personal information including Social Security numbers, driver's license details, bank account information, claim data, addresses, phone numbers, dates of birth, and account access PINs. Following detection, the agency locked affected accounts and implemented enhanced PIN security controls alongside broader network security improvements to mitigate further risks.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The Florida Department of Economic Opportunity (DEO) experienced a data breach impacting its Reemployment Assistance Claims and Benefits Information System (CONNECT), which supports unemployment benefits. Between April 27, 2021, and July 16, 2021, unauthorized actors accessed 57,920 claimant accounts, potentially exfiltrating sensitive personal and financial data. The DEO discovered the intrusion on July 16, 2021, and notified affected individuals via letters dated July 23, 2021. Compromised information included Social Security numbers, driver’s license numbers, bank account details, claim-related data, addresses, phone numbers, dates of birth, and account PINs used to access CONNECT. The breach exposed claimants to identity theft and financial fraud risks due to the breadth of personal identifiers involved. No evidence suggested broader system compromise beyond the targeted accounts.
In response, the DEO immediately locked all affected CONNECT accounts to prevent further unauthorized access. The department enhanced PIN security controls and fortified network security systems, though specific technical measures were not disclosed. Impacted individuals were advised to monitor financial accounts and credit reports for suspicious activity. The agency did not confirm whether attackers exploited specific vulnerabilities or the breach’s root cause. No ransomware or extortion demands were reported in connection with the incident. The CONNECT system remained operational during and after the investigation, with no mention of service disruptions or recovery timelines.