What’s truly surprising is that even the backup files are being held hostage as well. The hacker behind this not only brought down the database but also every single backup available. The state agency’s site has been for six days (and counting), unable even to restore to last week’s or even last month’s data.

What’s even more shocking is that the news media have buried this story. This should be a huge wakeup call to the vulnerability of government IT systems, potentially to attack by other states or terrorist groups. It’s not just a breach of stolen data, it’s a full-blown attack on a government agency’s ability to function. In my opinion, hat makes it the scariest data breach in the US in recent years.

On a lighter note, here’s a link to the Virginia Data Bandit’s ransom note: http://file.sunshinepress.org:54445/virginia-ransom-2009.html.

Oh, and time’s up tomorrow, May 6th.

I noticed your question at the end of your post and thought I would provide you with a quick analysis of my thoughts on the requirements for breach notification under federal and state law.

I added a “update” at the bottom of my original post on the situation.