St. Lucie County Tax Collector’s Listed by alphv Ransomware Group

On November 13, 2023, the St. Lucie County Tax Collector’s office in Florida appeared on the leak site operated by the alphv ransomware group. The listing states that internal files were exfiltrated during a ransomware attack, with a partial sample already published and a full data dump promised soon. The sample and description indicate the presence of highly sensitive personal information including SSNs, addresses, dates of birth, driver’s licenses, W-4 forms, W-9 forms, and credit card details.

Details from the Leak-Site Listing

The alphv leak page for this incident explicitly notes “Proof of Leakage First part listing” followed by the warning “Full data dump soon.” It describes the stolen material as containing more personal data with SSN, address, DOB, DL, W4, W9, and CC. The disclosure does not quantify the number of affected individuals, nor does it specify the exact volume of records or the precise systems that were initially compromised. What is confirmed is that the county tax collector’s internal files were taken and are now held by the extortion actors.

November 13, 2023 marks the first public listing of this claimed breach on the alphv portal. The notification style is typical of modern ransomware operations: a partial leak to prove access, followed by the threat of wholesale publication unless payment is made.

Why This Matters for You and Your Family

If you or any member of your household has lived in St. Lucie County, worked there, or conducted business with the Tax Collector’s office, your personal information may now sit on a criminal server. Tax offices routinely handle driver’s license renewals, property records, tax filings, and payment information. A breach of this type therefore exposes the exact details criminals need to file fraudulent tax returns, open accounts in your name, or impersonate you with government agencies.

SSNs, driver’s licenses, dates of birth, and credit card numbers together create immediate financial and identity-theft risk. Even if the full dump has not yet been released, the partial files already published give threat actors enough to begin targeted attacks against residents and employees alike.

The Doxxing and Identity-Chain Implications

Once SSNs, addresses, and dates of birth leave official custody, they rarely stay isolated. Criminals combine them with usernames, emails, or phone numbers obtained from other breaches to build detailed profiles. These identity chains can link your government records to social-media handles, gaming accounts, and family members’ information. Children’s records are especially vulnerable because parents often reuse credentials across tax portals, email, and online gaming services.

A single leak like this can cascade into account takeovers that expose chat logs, friend lists, and location data, accelerating doxxing campaigns. Public reporting on similar incidents shows that ransomware groups frequently sell or auction such datasets on underground forums, where buyers specifically hunt for combinations of government identifiers and personal contact details.

Alphv’s Publicly Known Track Record

Public reporting attributes the alphv ransomware group, also known as BlackCat, with emerging in late 2021. The gang has since claimed responsibility for attacks against hundreds of organizations across healthcare, education, local government, and critical infrastructure sectors. Notable prior victims include large healthcare providers, municipal governments, and technology companies. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by rapid exfiltration of sensitive files before encryption. They then publish samples on their leak site and demand payment within a short window, often threatening to release the full archive or sell it to third parties if unpaid.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity drawn from this and prior exposures.
• Rotate any password you have used with the St. Lucie County Tax Collector’s online systems and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same address and parent credentials.
• Let remediation specialists handle takedown requests and broker removal on your behalf while you focus on securing accounts and freezing credit reports.

The incident underscores how quickly local-government data can fuel broader identity crimes when it lands in the hands of professional ransomware operators. Acting promptly on the credentials and personal details already at risk can limit the damage before the promised full dump appears. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage provide a practical way for you and your family to track and reduce these cascading exposures, including those that threaten children’s gaming accounts.