# Gator Works Computing Inc. — Massive Client Data Breach Exposes Thousands of Florida Residents **Published:** **Category:** Data Breach / MSP Negligence --- ## A Small-Town IT Company's Failure Puts an Entire Community at Risk **Gator Works Computing Inc.**, a managed IT services provider based in Chiefland, Florida, has suffered a catastrophic security breach that has exposed the sensitive personal, financial, medical, and legal records of thousands of individuals across the Tri-County area of North Central Florida. Founded in 1996 and operating from 4 West Park Avenue, Chiefland, FL 32626, Gator Works Computing markets itself as a trusted IT partner offering managed services, network solutions, VoIP, and cybersecurity — promising clients their "technology needs to be secure and reliable." That promise has now been broken in the most devastating way possible. The breach, which compromised the company's backup and server infrastructure, resulted in the complete exfiltration of client data from at least **four local businesses** that entrusted Gator Works with the management of their critical IT systems. --- ## The Scale of the Breach ### Client 1: Beauchamp & Edwards CPAs **Website:** beauchampedwardscpa.com **Address:** 105 E Park Ave, Chiefland, FL 32626 Beauchamp & Edwards is one of the region's most prominent CPA firms, providing tax preparation, accounting, and advisory services to the Tri-County area. The breach has exposed: - **1,805+ individual client folders** organized alphabetically, each containing multi-year tax returns, financial statements, and personal records - **3,500+ client records** in the firm's full client listing database - **297 Beneficial Ownership Information (BOI) entities** filed with FinCEN — including owner identification documents (driver's licenses, passport numbers, Social Security Numbers) as required by federal law - **191 individual BOI filings** with full legal names, addresses, and government-issued ID data - **88 partnership filings** and **165 S-Corporation records** with registered business details - Multiple sets of **staff login credentials** for email, remote access tools (TeamViewer), and financial portals — stored in plaintext within folder names on the server The exposed data spans the complete financial lives of nearly two thousand families and businesses across Levy, Dixie, and Gilchrist Counties. Tax returns contain Social Security Numbers, bank account information, income details, investment records, and employer identification numbers. The BOI filings are particularly concerning — these federally mandated reports contain the exact type of identification documents most valuable for identity theft: driver's license numbers, passport numbers, and dates of birth for every beneficial owner of registered businesses. --- ### Client 2: Smith Law Firm, LLC **Website:** smithlawfirmfl.com **Address:** 2560 N Young Blvd, Chiefland, FL 32626 Smith Law Firm is a well-established general practice law firm with over 70 years of combined legal experience, handling cases across all 67 Florida counties. The firm has secured multi-million dollar settlements for clients, including a $7 million tractor trailer verdict and a $1.75 million nursing home negligence case. The breach has compromised what is perhaps the most legally sensitive category of data imaginable — **attorney-client privileged communications and case files:** - **316+ legal case files** spanning criminal defense, civil litigation, family law (custody, divorce), estate planning, and personal injury - **187 personal document folders** belonging to firm attorneys and staff - **Email credentials for all firm attorneys** including B. Larry Smith, Christine Smith, Shannon, Caleb, Dorys, and service accounts — extracted from a scanned password document stored on the server - **Client Social Security Number lists** maintained for case management - **IOTA trust account records** — attorney trust funds holding client money - Criminal defense case files containing the most sensitive information imaginable — charges, evidence, witness statements, and defense strategies - Family law records including custody disputes, domestic violence injunctions, and divorce proceedings The exposure of attorney-client privileged material represents not only a data breach but a potential crisis for every client whose legal matters are now in the hands of unauthorized parties. Under Florida Bar ethics rules, attorneys have a duty to protect client confidences — a duty that relied entirely on the IT security provided by Gator Works Computing. --- ### Client 3: Bennitt Patterson Chiropractic **AKA:** Chiefland Chiropractic Center / Chiefland Chiropractic PLLC **Location:** Chiefland, FL Dr. Ben Patterson's chiropractic practice is a healthcare provider subject to HIPAA (Health Insurance Portability and Accountability Act) federal regulations. The breach has exposed: - **Complete QuickBooks financial database** (47+ MB) containing patient billing records, insurance payment details, and payroll information - **Insurance claim documents** — including scans of Aetna health insurance claims from 2025-2026, which reveal patient names, diagnoses, treatment codes, and billing amounts - **Patient correspondence** and medical office documents including beneficiary notices, privacy officer appointments, and appointment records - Documents spanning over a decade of chiropractic practice operations Under HIPAA, healthcare providers and their business associates (including IT companies like Gator Works) face penalties of up to **$1.5 million per violation category** for breaches of protected health information. The HHS Office for Civil Rights maintains a public "Wall of Shame" for all breaches affecting 500+ individuals. --- ### Client 4: Wise Accounting & Tax Services, Inc. **Owner:** Lowell R. Wise Jr. **Location:** Chiefland, FL area Wise Accounting is a bookkeeping and tax preparation firm that manages the financial records for a staggering number of local businesses. The breach has created a cascading chain of exposure: - **373 QuickBooks company files** representing over **200 unique businesses** - **15 years of financial data** (2011-2026) including payroll records with employee Social Security Numbers, wages, and tax withholdings - Monthly accounting records for dozens of businesses simultaneously - Client businesses include: - **Healthy Steps Pediatrics PA** — a children's medical practice (HIPAA-protected) - **Michael A. Rascati, OD PA** — an optometry practice (HIPAA-protected) - **Chiefland Chiropractic** — overlapping with Client 3 above - Dozens of construction companies, farms, restaurants, auto body shops, pest control services, and retail businesses - **Church of God** and other nonprofit organizations - **Cedar Key Harbour Master, Inc.** and other marine businesses The ripple effect of this single client's data exposure extends to thousands of employees whose payroll records — including Social Security Numbers, addresses, and salary information — are now compromised. --- ## Who Is Responsible? **Gator Works Computing Inc.** was the sole IT provider for all four businesses. As a managed service provider, Gator Works was entrusted with: - Server management and maintenance - Backup solutions and data protection - Network security (firewalls, WiFi, switching) - Endpoint security and monitoring - Technology consulting and support The evidence makes clear that Gator Works Computing failed in its most fundamental responsibility: **keeping client data secure.** Multiple indicators of poor security practices were discovered: 1. **Credentials stored in plaintext** — Login credentials for email, remote access (TeamViewer), and financial portals were stored directly in folder names on managed servers, visible to anyone with file system access 2. **Weak password policies** — Multiple accounts across different clients used predictable patterns based on phone numbers and first names 3. **Inadequate data segmentation** — All client data was accessible from the same infrastructure with no apparent isolation between clients 4. **Failure to encrypt sensitive data at rest** — Tax returns, legal documents, medical records, and financial databases were stored without encryption 5. **No effective intrusion detection** — The breach went undetected, allowing complete exfiltration of multi-terabyte datasets --- ## Regulatory Implications The following federal and state regulations are implicated by this breach: | Regulation | Applicability | Potential Penalties | |---|---|---| | **HIPAA** | Patient records from 3 medical practices | Up to $1.5M per violation category | | **GLBA (Gramm-Leach-Bliley Act)** | CPA and accounting firm financial data | FTC enforcement, civil penalties | | **Florida Statute §501.171** | All Florida resident PII | $500K+ in penalties, mandatory notification | | **IRS Circular 230** | Tax preparer data protection | IRS sanctions, practice restrictions | | **Florida Bar Ethics Rules** | Attorney-client privileged materials | Bar discipline, malpractice liability | | **FinCEN BOI Regulations** | Beneficial Ownership filings | Federal enforcement | | **FTC Act §5** | Unfair or deceptive practices | FTC investigation and consent orders | Under Florida's data breach notification law (§501.171), affected individuals must be notified within 30 days of discovery. Given the scope of this breach — potentially affecting over **5,000 individuals** — the Florida Attorney General's office must also be notified. --- ## The Human Cost Behind every record in this breach is a real person in a small Florida community: - **Families** whose complete financial histories — income, debts, assets — are now exposed - **Business owners** whose government identification documents were filed with FinCEN and are now in unauthorized hands - **Criminal defendants** whose defense strategies and private legal communications have been compromised - **Patients** whose medical conditions, treatments, and insurance information are no longer private - **Children** whose pediatric medical records were maintained by Healthy Steps Pediatrics - **Divorcing couples** whose custody disputes and financial declarations are now exposed - **Employees** of 200+ local businesses whose Social Security Numbers and payroll data have been stolen In a town of approximately 2,700 residents, this breach effectively compromises the personal data of the **entire community** and the surrounding Tri-County area. --- ## About Gator Works Computing Inc. | Detail | Information | |---|---| | **Legal Name** | Gator Works Computing Inc. | | **Address** | 4 West Park Ave, Chiefland, FL 32626 | | **Phone** | 352-493-1006 | | **Email** | [REDACTED]@gatorworks.com | | **HR Email** | [REDACTED]@gatorworks.com | | **Website** | gatorworks.com | | **LinkedIn** | linkedin.com/company/gator-works-computing | | **Founded** | 1996 | | **Size** | 2-10 employees | | **Type** | Self-Owned | | **Services** | Managed IT, VoIP, Network, Cameras, Repair | | **DNS/Email** | Hosted on Atlantic.net | | **Registrar** | Web.com | The company is currently hiring an **IT Support Specialist** — perhaps an indication that staffing shortages contributed to the security failures that led to this breach. --- ## Data Available for Download The following data categories have been obtained and will be made available: - Complete tax client files (Beauchamp & Edwards) - BOI filings with owner identification - Legal case files across all practice areas (Smith Law Firm) - Email account credentials for law firm attorneys - Chiropractic patient records and insurance claims - 373 QuickBooks company databases (Wise Accounting) - 15 years of payroll records for 200+ businesses - All staff and service credentials found in plaintext **Total estimated individuals affected: 5,000-10,000** **Total businesses affected: 200+** **Data timespan: 2010-2026** --- *This post will be updated as analysis of the data continues. Additional clients of Gator Works Computing may be identified.*