ORLANDO, FL – In a shocking case of corporate neglect, Jelly Bean Communications Design LLC (Jelly Bean) and its manager, Jeremy Spinks, have agreed to pay $293,771 to resolve False Claims Act allegations that they failed to secure personal information on a federally funded Florida children’s health insurance website, which Jelly Bean created, hosted, and maintained.
According to the allegations, from January 1, 2014, through December 14, 2020, Jelly Bean did not provide secure hosting of applicants’ personal information and instead knowingly failed to properly maintain, patch, and update the software systems underlying HealthyKids.org and its related websites, leaving the site and the data Jelly Bean collected from applicants vulnerable to attack.
The Florida Healthy Kids Corporation (FHKC) is a state-created entity that offers health and dental insurance for Florida children ages five through 18. FHKC receives federal Medicaid funds as well as state funds to provide children’s health insurance programs. On October 31, 2013, FHKC contracted with Jelly Bean for “website design, programming and hosting services.”
The settlement announced today resolves allegations that Jelly Bean did not provide secure hosting of applicants’ personal information and knowingly failed to properly maintain, patch, and update the software systems underlying HealthyKids.org and its related websites, leaving the site and the data Jelly Bean collected from applicants vulnerable to attack.
In or around early December 2020, more than 500,000 applications submitted on HealthyKids.org were revealed to have been hacked, potentially exposing the applicants’ personal identifying information and other data. The United States alleged that Jelly Bean was running multiple outdated and vulnerable applications, including some software that Jelly Bean had not updated or patched since November 2013.
Jelly Bean’s failure to secure the website and its data resulted in a significant breach of trust with the families who relied on the company to safeguard their children’s personal information. The outcome of this case serves as a warning to companies that handling personal information must ensure that such information is appropriately protected.
“Government contractors responsible for handling personal information must ensure that such information is appropriately protected,” said Principal Deputy Assistant Attorney General Brian M. Boynton, head of the Justice Department’s Civil Division. “We will use the False Claims Act to hold accountable companies and their management when they knowingly fail to comply with their cybersecurity obligations and put sensitive information at risk.”
Defendant: Jelly Bean Communications Design LLC (Jelly Bean)
Criminal Charges: False Claims Act liability for cybersecurity failures
City and State: Orlando, Florida
Exact Date: October 31, 2013
Sentence or Outcome: $293,771 settlement
Dollar Amount: $293,771
Related Federal Cases
- Danny Ray Murphy, Online Child Exploitation, Florida 2024 · North Carolina
- Franklin Valverde Jr., Streaming Piracy, Florida 2021 · Connecticut
- Adam Colin Todd, AML Program Failure, Florida 2024 · South Carolina
- Michael Ron David Kadar, Passport Snooping, Florida 2023 · District of Columbia
- Emily Wilson, Identity Theft Scheme, Florida 2022 · Connecticut
Key Facts
- State: Florida
- Category: Cybercrime
- Source: DOJ Press Release â†â€â€
ðŸâ€Â’ Get the grimiest stories delivered weekly. Subscribe free →
MORE FEDERAL CRIME NEWS
CybercrimeCybercrimeCybercrimeCybercrime