Data breach of third-party company affects personal info of employees

guest · Feb 16, 2020

Information of nearly 1,900 Wake County government employees disclosed in data breach
February 14, 2020
https://abc11.com/5931683/

The personal information of nearly 1,900 Wake County Government employees has been leaked to an unauthorized third party in a security breach.

The county's former flexible benefit spending accounts administrator, Interactive Medical Systems, experienced a data security breach that exposed the names, dates of service and partial social security numbers of the affected employees, Wake County officials said.
The county said the personal information of any other Wake County employees or residents were not affected.

"It's important to note that this was not a breach of a county system, nor was it caused by a county employee," said Wake County's Chief Information and Innovation Officer Bill Greeves. "IMS has confirmed the breach was the result of a phishing attack against an IMS employee."
Click to expand...

guest · Feb 29, 2020

Data breach potentially impacts hundreds of Brunswick County Schools employees
February 28, 2020
https://www.wwaytv3.com/2020/02/28/...ndreds-of-brunswick-county-schools-employees/

The company that administers the Flexible Spending Account plans for Brunswick County Schools had a data breach, which means hundreds of school employees may be affected.

Interactive Medical Systems Corporation is the third-party company that administers the employee benefit plan. The company noticed an IMS employee’s email account was the victim of a phishing attack on December 31.
The investigation confirmed that emails within the affected user’s email account between July 19 and December 31 were exposed to an unknown unauthorized third party as a result of the phishing attack.

IMS determined that the categories of personal information exposed varies for each affected individual and may have included: First and Last Name, Last Four Digits of Social Security Number, Transaction Date and Amount, [...]
Click to expand...

guest · Feb 29, 2020

Data breach exposed some Lincoln County Schools workers’ private information
February 28, 2020
https://www.wsoctv.com/news/local/d...ivate-information/IJZYPS44U5EVHH7KRXALIJTVY4/

The company that handles the district’s employee benefits plan, Interactive Medical Systems Corporation, said it was attacked in a phishing scam.

This resulted in a “sophisticated" phishing attack, which means there was an email that appeared to be legitimate and was used to entice the user into giving up login information.
It said the names and social security numbers of a couple of school employees were exposed.

The company is offering a year of free credit monitoring to those impacted.
Click to expand...

guest · Feb 29, 2020

Social security numbers of BCPS employees breached
February 29, 2020
https://www.morganton.com/news/crim...cle_c7ca35cc-973b-54c1-800c-68d0e451f359.html

A company Burke County Public Schools contracts with said 16 BCPS employees had their names and full Social Security numbers exposed in a data breach.

IMS launched an investigation to find out how much information may have been impacted by the incident, and contracted a third-party cybersecurity firm for a comprehensive forensics investigation, the release said.
The investigation found no indication that Burke County Public Schools’ systems had been affected, according to the release.
However, it was confirmed that an unknown, unauthorized third party accessed emails from the affected user’s account between July 19 and Dec. 31 after a sophisticated phishing attack, the release said.
Click to expand...

guest · Feb 29, 2020

Johnston County Government Employees Notified Of Data Breach
February 28, 2020
https://jocoreport.com/johnston-county-government-employees-notified-of-data-breach/

The County of Johnston disclosed today (Friday) a data breach may have affected participants in one of its employee benefits plans. To administer those plans, Johnston County contracted with a third-party administrator, Interactive Medical Systems Corporation (IMS).
On December 31, 2019, IMS received a technical alert concerning the email address of an IMS employee which indicated the employee’s email account was compromised. There was no indication other accounts within IMS were affected.

IMS has assured Johnston County officials that it has taken steps to prevent a similar event from occurring in the future, and to otherwise protect the privacy and security of plan participant information.
Affected Johnston County employees were notified by mail Feb. 14th of the data breach
Click to expand...

guest · May 10, 2020

Data breach of e-payroll vendor PaperlessPay - Thousands of employees at risk of identity theft
Data Breach Announced by PaperlessPay Corp.
May 1, 2020
https://www.justice4you.com/blog/paperlesspay-corp-data-breach.html

On February 19, 2020, the Department of Homeland Security (DHS) alerted PaperlessPay Corp. that their clients’ employee data was for sale on the dark web. PaperlessPay Corp. confirmed that an unauthorized party gained access to their SQL service on February 18, 2020.

PaperlessPay Corp. then notified its clients about the cyberattack. The company provides electronic paystubs under the product names my-eStub.com and PPCStubs.com for the staff of hospitals, utility providers, and other employers. It is unknown how many of PaperlessPay Corp.’s 1500 clients were affected by the security incident.
Potentially compromised information is associated with paycheck stubs, W-2 forms, and payroll deposits, and may include: [...]

PaperlessPay Corp. claims to have hosted 8 million paystubs and delivered over 106 million W-2 forms. It is unknown how many of the company’s 2.3 million enrolled users may be affected by this data breach.
Click to expand...

So far, the following PaperlessPay Corp. clients have disclosed the data breach to their current and past employees:

Marshall Medical Center – hospital system in El Dorado County, California

Community Memorial Health System – hospital system in Ventura County, California

Orlando Utilities Commission – water & electric public utility provider in Orlando, Florida

Fareway Stores – Midwest grocery store company based in Boone, Iowa

Lee Auto Malls – automotive dealer in Maine

MP Environmental Services, Inc. – transportation, demolition and remediation company based in Bakersfield, California

Click to expand...

In other data breach news, PaperlessPay, which produces electronic paystubs for employees, also had a data breach. Tons of companies use it — hospitals, utility providers, and more. DHS discovered the possible breach and warned the company.
More: https://orlandosentinel.com/news/crime/os-ne-ouc-data-breach-20200429-zhayied765asxcqesgqgbha664-story.html

— Zack Whittaker (@zackwhittaker) April 29, 2020
Click to expand...

guest · Jun 5, 2020

Two Data Breaches Hit Kentucky Employees’ Health Plan
June 4, 2020
https://www.govtech.com/security/Two-Data-Breaches-Hit-Kentucky-Employees-Health-Plan.html

Nearly a thousand members of Kentucky Employees’ Health Plan (KEHP) were victims of a data breach that took place in late April and mid-May, according to a statement released by the Commonwealth of Kentucky Personnel Cabinet on June 2.

During the first attack, from April 21 to 27, 971 KEHP members accounts were accessed by a “bad actor” who used valid login information to infiltrate StayWell, a third-party vendor utilized by KEHP members for their well-being and incentive portal.
This portal offers financial rewards for completion of certain challenges and goals in order to promote a healthier lifestyle among members.
Click to expand...

The investigation determined that this “bad actor” was able to get access to valid logins from an external site outside of the StayWell system. To their knowledge, the attacker was an outsider with no previous connection to StayWell, Goodwin said.
After the first attack, StayWell took its site down in order to “introduce new security enhancements,” according to the website.

The second data breach, occurring from May 12 to 22, was a direct result of the first. StayWell estimates that 42 of the original 971 targeted members also had their Commonwealth email accounts infiltrated in the second attack, Goodwin said.
Click to expand...

guest · Jul 31, 2020

mood said: ↑

Data breach of e-payroll vendor PaperlessPay - Thousands of employees at risk of identity theft
Data Breach Announced by PaperlessPay Corp.
May 1, 2020
https://www.justice4you.com/blog/paperlesspay-corp-data-breach.html
Click to expand...

...some months later:
"Notification from Emanate Health to the California Attorney General’s Office" (PDF):
https://oag.ca.gov/system/files/EH%20Standard%20Notice%20AA977_v03.pdf

What Happened? We received notice from PaperlessPay on March 20, 2020 informing us that an unauthorized person gained access to its computer server. PaperlessPay learned of the incident on February 19, 2020 when the Department of Homeland Security (“DHS”) contacted PaperlessPay to inform them that an unknown person was purporting to sell “access” to the PaperlessPay database on the dark Web. [...]

What Is PaperlessPay Doing? PaperlessPay has indicated that it has acted to secure its network and prevent future incidents. In order to resume its services, PaperlessPay has rebuilt an entirely new domain controller, a new web server, and a new SQL server. [...]

For Emanate Health’s part, we have been working with PaperlessPay to obtain details of the incident and the affected accounts and to obtain assurances that information about our employees is safe.
Click to expand...

Log in or Sign up

Data breach of third-party company affects personal info of employees

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Data breach of third-party company affects personal info of employees

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches