City of Jacksonville Beach Tells Maine Regulators a 2024 Breach Hit 48,949 People

The City of Jacksonville Beach, Florida told Maine's Attorney General that unauthorized access to its network between January 22 and January 29, 2024 exposed names and Social Security numbers for 48,949 people, including 38 Maine residents. The city's own notice, filed through its deputy city manager, says it discovered the intrusion on February 22, 2024 and began notifying affected people on March 20, 2024.

What the city's own notice says

Filed under Maine's data-breach reporting law, the notice identifies the City of Jacksonville Beach as the reporting entity and gives a precise scope: The notice dates the unauthorized access to a one-week window and gives a later discovery date: It describes the cause as and lists the data types taken as

Consumer notification went out on March 20, 2024, and the city offered identity-theft protection through a named vendor: Maine's is the only state regulator filing this page found that states a company-wide number; the city has not published its own public breach-notification total separately from what each state's attorney general received.

Who local reporting says was behind it

The city's own notice does not name an attacker. Local reporting, citing law enforcement sources, attributed the intrusion to a known ransomware group: The same wave of attacks drew coverage because multiple Florida municipalities reported incidents in the same stretch of 2024, a pattern a trade outlet covering the cluster described this way: , confirming the figure independently of the state filings this page cites directly.

What isn't on the record

No class action or other civil complaint naming the City of Jacksonville Beach or its municipal utility, Beaches Energy Services, over this incident turned up in a search of court records for this page. No source found states a nationwide or Florida-specific total distinct from the AG-filing counts above. The city has no security-leadership record yet on CISO Tribune, the network's mothership site, and this page names no individual as responsible for the breach.

FAQ

What happened in the Jacksonville Beach data breach? The City of Jacksonville Beach, Florida told Maine's Attorney General that unauthorized access to its network between January 22 and January 29, 2024 exposed names and Social Security numbers; the city discovered the intrusion on February 22, 2024 and began notifying affected people on March 20, 2024.

How many people were affected by the Jacksonville Beach data breach? The city's own notice to Maine's Attorney General states 48,949 people were affected in total, including 38 Maine residents; the city offered twelve months of identity-theft protection through Epiq.

Who was behind the Jacksonville Beach cyberattack? The city's own regulatory filing does not name an attacker. Local reporting by News4JAX, citing law enforcement, attributed the intrusion to the LockBit ransomware group.

Was there litigation over the Jacksonville Beach data breach? No class action or other civil complaint naming the city or Beaches Energy Services over this incident was found on the record as of this page's publication.

For more disclosed incidents sourced from a state attorney general's own breach-notification filing, see the state breach-notification-law guide and the sector browse hub.