The Seminole County Clerk of the Circuit Court & Comptroller discovered an intrusion at about 5 p.m. on Wednesday, October 28, and responded by cutting internet access. By Thursday the website and the phone system were both offline and the counters were taking cash and check only, WKMG reported. On Friday, October 30, every location closed to the public, and Clerk Grant Maloy told Spectrum News 13 the office aimed to reopen Monday. It reopened in stages instead. At 18:23 GMT on November 5 the notice on the Clerk's homepage listed three Sanford locations open 8:00 a.m. to 4:30 p.m. and added that "all other clerk's office locations will remain closed, and online services will remain unavailable until further notice."
Nothing was encrypted, on the Clerk's own account — his statements are the only source for that, uncorroborated by any third party, but he was specific: "So the system itself was not ransomware. It was not locked down by a bad guy. It was us turning things off to assess the situation." The Clerk has not disclosed an initial access vector, and no group has claimed the incident: a check of 33,879 leak-site posts on data.ransomware.live on November 5 returns no listing for the office.
The outage was a decision, and the decision had a shape
Full isolation appears in nearly every incident response plan and is priced in almost none. Pulling the cable produces two numbers, both decided long before the morning you need them. How long is set by evidence: you can only reconnect what you can prove the intruder did not reach, and that proof comes out of logs you either retained or didn't. How things come back is set by architecture, and that part is visible from outside right now.
Three hostnames in this incident sat in three different address blocks:
seminoleclerk.org 104.18.26.113 Cloudflare HTTP 200
courtrecords.seminoleclerk.org 64.187.122.41 Seminole Co. Clerk no connection
www.myflcourtaccess.com 199.127.92.221 FL Assoc. of Court HTTP 200
Clerks, Inc.
Those owners come from WHOIS on each netblock. The front door was on a CDN and served the closure notice straight through. Statewide e-filing runs on the Florida Courts E-Filing Authority's portal, in Florida Association of Court Clerks address space, and was unaffected. The public records application lived in 64.187.122.0/24, registered to the Clerk itself, and accepted no connection at 18:24 GMT on November 5 — eight days after discovery, and after the counters had reopened. The phones went down too, so the voice path crossed the same egress boundary as the data path.
Build the isolation dependency table
Give each of your top ten business services four columns: who actually serves it, what it needs outbound to run, what it needs to come back, and who can grant relief while it is down.
The first column is cheap and it predicted every outcome above. One dig +short <host> and one whois on the answer tells you whether a service lives in your address space or somebody else's. Anything on a third party's network survives your cut; anything in your own goes dark with it. Ten hostnames is an afternoon.
The second column is expensive, because the honest answer is often "nobody here knows." Licence and activation checks, the identity provider, MFA push delivery, external DNS forwarders, NTP, OCSP and CRL endpoints, cloud backup targets, the mail relay, the payment processor. Do not fill it in with a questionnaire — block egress on a test instance and watch what refuses to start. That costs a couple of hours per service and needs the person who runs it rather than an inventory export, which is the real reason it goes undone. Expect it to surface a service nobody has owned for years, the same way reconciling two device lists that disagree does.
Column three is restoration order, written down beforehand because during an outage order gets decided by whoever is loudest. The constraints are fixed: the identity provider comes back before anything that authenticates against it, logging and EDR before the systems you are trying to watch, and whatever you are least sure about last or rebuilt. If you plan to wipe a host, pull its evidence before the rebuild destroys it — a restore is a destructive act against your own forensics.
If you cannot get to the table at all, do the evidence half. Isolation duration has a floor equal to how long it takes to answer "what did they touch." If your firewall, DNS and authentication logs roll over in seven days, no amount of responder skill ends the outage sooner. That is a storage line item, not a security program.
Column four is the one Seminole exercised: deadlines and payment due dates were extended with no penalties. Somebody had the standing to decide that. The equivalent authority elsewhere — waiving an SLA, extending a filing deadline, accepting paper — is unassigned until the morning it is needed, the same gap as a plan with no trigger.
What to check this week
- Run
dig +shortandwhoison each of your top ten service hostnames and record your netblock or a third party's. That column is your survival list. - For each service in your own space, name the outbound dependency it cannot start without, then verify it by blocking egress on a test instance.
- Write down the retention window in days for firewall, DNS, authentication and EDR logs. That is the floor under your isolation.
- Name who can extend a customer or statutory deadline with systems down, and confirm they know they hold it.
- Check whether your phones ride the egress you would cut. If so, the cut takes your incident bridge with it.
North InfoSec runs AI-assisted penetration testing and security assessments, including the dependency mapping described above. northinfosec.com