Criminals who attacked Jacksonville Beach’s computer systems more than seven weeks ago may have stolen private information about some city employees and residents, the city said Wednesday.

Investigation revealed that the cyberattack was a sophisticated operation carried out by a criminal organization, the city said. The culprits may have obtained names, Social Security numbers, driver’s license numbers and bank account information for some employees and customers of Beaches Energy Services, the city said in a written statement,

City officials said they were notifying anyone affected. The city has “reviewed existing security policies and implemented additional measures to further protect against similar incidents moving forward,” the statement said.

The city said it is not aware of any misuse of information, but residents were warned to be vigilant.

Jacksonville Beach officials first reported Jan. 29 that a “cybersecurity event” had affected its digital infrastructure. The incident forced City Hall and most city facilities to shut down. Staff emails and online activities were inoperative. The incident also initially affected the city’s accounting functions.

Article continues below

More from Jax Today

Local first responder takes Christmas to Colombian orphans

Husband convicted in wife’s murder-for-hire killing

Runway hazards: More planes report hitting wildlife in Florida

Jacksonville Today thanks our sponsors. Become one.

Within days, City Hall reopened. Most staff were able to handle online work, and Beaches Energy and the city’s pollution control and water plant became fully operational, the city said in a statement at the time.

The continuing investigation determined that certain files in city systems were accessed illegally and information taken between Jan. 22 and 29, the city said Wednesday.

City officials have notified state and federal regulators. Anyone affected by the attack was advised to be alert for signs of identity theft or fraud.

The city provided these suggestions if you’re affected:

• People should review their account statements and monitor credit reports for suspicious activity and errors. Under U.S. law, a consumer is entitled to one free credit report annually from each of the three major credit reporting bureaus. To order a free credit report, go to annualcreditreport.com or call, toll-free, 1-877-322-8228.

• Consumers also have the right to place an initial or extended “fraud alert” on a credit file at no cost. An initial fraud alert is a one-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert on a consumer’s credit file, a business must take steps to verify the consumer’s identity before extending new credit. If consumers are the victim of identity theft, they are entitled to an extended fraud alert, which is a fraud alert lasting seven years. To place a fraud alert, contact any of the three major credit reporting bureaus: Equifax, 1-888-298-0045; Experian, 1-888-397-3742; or TransUnion, 1-800-916-8800.

• As an alternative to a fraud alert, consumers have the right to place a “credit freeze” on a credit report, which will prohibit a credit bureau from releasing information in the credit report without the consumer’s authorization. The credit freeze is designed to prevent credit, loans and services from being approved in a consumer’s name without consent. However, using a credit freeze may delay, interfere with, or prohibit the approval of any new loan, mortgage or other credit.

• To learn more about identity theft, fraud alerts, credit freezes and protection of personal information, contact the Federal Trade Commission or go to identitytheft.gov.

• Anyone who thinks they may have been affected by the data breach can call the dedicated assistance line at (844) 709-0703. It is available from 9 a.m. to 9 p.m. weekdays. Or they can go to jacksonvillebeach.org for more information.