NBC4 | May 7, 2009
Anne Reynolds

The FBI is on the trail of hackers who claim to have accessed the personal information of millions of Virginians. They're holding the information hostage, and are threatening to dispurse the sensitive data on the Internet if they don't receive a $10 million ransom.

The hacker or hackers posted the ransom note on "Wikileaks," a Web site that allows for anonymous tips about leaks of government information. The note claims that the personal information came from a raid on a state agency's computer database, and that the hackers are now in possession of 8 million patients' records, as well as 35 million prescription records. Those records may include Social Security numbers.

Investigators have reason to believe the threats from hackers may be credible; The Virginia Department of Health Professions has confirmed that there was an incident last Thursday where a hacker may have breached system servers.

"We take this very seriously," Virginia Department of Health Professions Director Sandra Whitely Ryals said. "That's why we took immediate steps to shut the system down, to secure the system, and to safeguard people's information."

Experts say these types of databases are always at risk.

"This particular hack, if, it in fact took place, is huge. It's very significant," Craig Butterworth with the National White Collar Crime Center said. Butterworth teaches police and other law enforcement entities how to investigate high-tech crimes.

"Businesses, agencies that maintain these databases, go through extensive reviews in order to keep the bad guys out. But again, we're back to that level of exposure, however minimal."

The Virginia Department of Health Professions has the responsibility of licensing 300,000 healthcare professionals. The agency's database includes prescription information, as part of a drug monitoring program to help prevent people from abusing prescription drugs.

The agency's computers are still down, as investigators slowly go through every computer file, looking for a breach.