Business owner claims someone changed state records and took his business

A Volusia County businessman claims a scammer hacked into state records and for days became the official president of his corporation.

Blair Burk started his company, that builds medical offices, 17 years ago. So, it was a total shock to see Florida's official corporate records show someone else took over his company.

“This man has gone in and said he was the president of my company and that just astounds my brain. I can’t even wrap my head around it,” Burk said.

Grant scams cheating those trying to pay hospital bills during COVID-19 pandemic

Burk’s company is Medical Facilities Construction Group.

But according to Florida's Division of Corporations, which keeps official records, Nicolas Carioti in South Florida was now the president of his company.

Someone had hacked official records that are kept online at Sunbiz.org.

“I never dreamed that you could just go in there and change this stuff,” Burk said.

According to Burk, when he asked state agency managers about the hack, he heard the system is not protected with passwords or authentication requirements before someone changes official corporate records.

Many customers angry after paying large deposits to contractor for work not done

“It’s just allowed. There’s nothing to stop it. And you ask the people up there and they say we’re sorry and to ask legislators to change it,” Burk said.

The state sends an email alert to the company that a change was made to corporate records.

But Burk says that email could be missed or sent to an old address, and in the meantime, someone could try to get a loan or open bank accounts based on hacked corporate information.

“He could do anything as far as I’m concerned. He could take out a loan. He could write a contract,” Burk said.

How to stop paying for gym membership if you don’t feel safe during pandemic

Todd Ulrich asked digital security expert Tommy Orndorf with Bayshore Interactive, to review what happened with Burk's company and check the Sunbiz site.

Orndorf discovered he could have made changes to his online corporate information with no passwords required.

“There needs to be a second level of authentication here, other than an email,” Orndorf said.

“Should this be a priority?” Ulrich asked.

“Absolutely. This is a critical time right now,” Orndorf replied.

COVID-19 brings new twist to family emergency scam

Action 9 contacted Florida’s Division of Corporations. The agency said they’re reviewing Burk’s complaint and the security issues involved.

Burk still doesn’t know the man’s identity who tried to steal his corporate title, for what seemed far too long.

“It took me three days to finally get it changed,” Burk said.

Even before the pandemic, there wasn't any legislative reform with wide support to add online corporate protections.

Since Action 9 first talked to Burk, his account was hacked again.

Cox Media Group