St. Lucie County Tax Collector’s Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 13, 2023, the St. Lucie County Tax Collector’s office in Florida was listed by the alphv ransomware group as a victim of a cyberattack. Public reporting indicates that internal files were exfiltrated during a ransomware incident, with the group claiming a first installment of proof-of-leak material and stating that a fuller data dump would follow. The number of people affected remains unknown, and independent confirmation of the full scope has not been detailed in available records.

The listing matters because a county tax collector’s office routinely handles sensitive financial and personal records tied to property ownership, tax payments, and related filings. Any unauthorized access or theft of such material carries direct consequences for residents and for the integrity of local government operations.

Breaking down the breach

According to the reported details, alphv publicly listed St. Lucie County Tax Collector’s on or around November 13, 2023. The group described the incident as a ransomware attack in which internal files were taken. Its leak-site notice characterized the material as a “Proof of Leakage First part listing” and indicated that a “Full data dump soon” would include additional personal data. No precise timeline for when the intrusion began, how long attackers remained inside the network, or the exact volume of data removed has been disclosed in the available facts. The number of individuals potentially affected is listed as unknown. Method of initial access, ransom demands if any, and whether systems were encrypted in addition to data theft are likewise unconfirmed in public summaries of the incident.

What is established is the group’s claim of exfiltration and its assertion that further material containing personal identifiers would be released. Beyond that claim and the reported date of the listing, operational specifics remain limited.

Inside alphv

alphv, also widely known in public reporting as BlackCat, is a ransomware operation that emerged in late 2021 and has been documented as a ransomware-as-a-service enterprise. The group typically recruits affiliates who conduct intrusions, deploy ransomware, and exfiltrate data before posting victims on a dedicated leak site if payment is not made. Public analyses of alphv activity describe the use of custom ransomware written in Rust, double-extortion tactics that combine encryption with data theft, and pressure campaigns that include timed releases of stolen files. The group has been linked to attacks across multiple sectors, including government, healthcare, and critical infrastructure, and has appeared on law-enforcement advisories for its scale and technical sophistication.

In this case, alphv’s leak-site listing constitutes a claim by the group that it holds data belonging to St. Lucie County Tax Collector’s. No independent forensic confirmation of every asserted detail is contained in the provided facts; the listing itself is the primary public assertion connecting the actor to this victim.

About St. Lucie County Tax Collector’s

St. Lucie County Tax Collector’s is a local government office responsible for collecting property taxes, issuing certain licenses and permits, and administering related fiscal functions for residents and businesses in St. Lucie County, Florida. Offices of this type serve as custodians of records that link individuals and entities to real property, tax obligations, payment histories, and supporting identity documentation. Because the work is statutory and continuous, the office maintains ongoing repositories of personally identifiable and financial information necessary to perform its duties.

A breach affecting such an entity is consequential precisely because the data it holds is both sensitive and relatively stable over time. Compromised tax and identity records can be reused for fraud long after an initial incident, and public trust in local revenue collection depends on the perceived security of those systems. The incident therefore raises questions not only about immediate data exposure but about the broader resilience of county-level administrative infrastructure.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. The alphv listing further claims that a fuller release would contain “more personal data with SSN, address, DOB, DL, W4, W9, CC.” These categories—Social Security numbers, physical addresses, dates of birth, driver’s license information, tax withholding forms (W-4 and W-9), and credit-card data—are asserted by the group rather than independently itemized in confirmed inventories. Exact file counts, the proportion of records that actually contain each data type, and whether every claimed category is present remain unconfirmed beyond the group’s notice.

Organizations performing tax-collection functions commonly retain precisely these classes of information in the ordinary course of business. Until a detailed forensic accounting or official notification is published, however, the precise contents of the stolen set should be treated as alleged rather than fully verified.

What's at stake

For individuals whose information may have been taken, the concrete risks include identity theft, tax-refund fraud, account takeover, and targeted phishing that leverages accurate personal details. Social Security numbers and dates of birth, if present, are particularly durable identifiers that can enable fraudulent credit applications or government-benefit claims. Driver’s license data and addresses can support document forgery or physical-world scams. Credit-card information, if included, creates immediate financial-exposure concerns.

For the Tax Collector’s office itself, the stakes involve potential disruption of tax-collection services, costs of investigation and remediation, possible regulatory or contractual notification obligations, and erosion of public confidence. Because the number of affected people is unknown, the full scale of downstream harm cannot yet be quantified. The combination of claimed personal and financial data nonetheless places both residents and the institution in a position that requires careful monitoring and response.

What to do if you're exposed

If you have conducted business with St. Lucie County Tax Collector’s or believe your information may have been involved, begin by monitoring financial accounts and credit reports for unfamiliar activity. Consider placing a fraud alert or credit freeze with the major credit bureaus, and be alert to unsolicited communications that reference tax matters or personal details. Retain any official notices you receive from the office or from law enforcement. As a further practical step, you can run a free exposure scan of your email address to check whether it has already appeared in known breach datasets, which may help you gauge whether additional credentials or personal information require attention.

AICompiled with AI assistance from public sources and published under our editorial standards.