Data breach in online unemployment system exposes private information

guest · May 16, 2020

Social Security numbers, banking information left unprotected on Arkansas PUA website
May 15, 2020
https://arktimes.com/arkansas-blog/...tion-left-unprotected-on-arkansas-pua-website

A computer programmer applying for unemployment on Arkansas’s Pandemic Unemployment Assistance program discovered a vulnerability in the system that exposed the Social Security numbers, bank account and routing numbers and other sensitive information of some 30,000 applicants. Anyone with basic computer knowledge could have accessed personal information for malicious purposes.

In exploring the website, the computer programmer determined that by simply removing part of the site’s URL, he could access the administrative portal of the site, where he had the option of editing the personal information of applicants, including bank account numbers.
The computer programmer said he thought he could have programmed a script that would gather all of the information from the API in under an hour. He did not.

“It’s a really big issue, my Social Security number is in there,” he said. “It’s unfortunate. I’m trying to get assistance and might get hacked.”
Click to expand...

guest · May 17, 2020

Data breach in new Illinois online unemployment system exposes private information
May 17, 2020
https://www.chicagotribune.com/coro...0200517-njjwtky6uvaetj2rln5lhdjy4u-story.html

A glitch in a newly launched state system for processing unemployment claims for gig workers publicly exposed personal information, a spokeswoman for Democratic Gov. J.B. Pritzker said Sunday.

The Illinois Department of Employment Security “is aware there was a glitch” in a new system for processing unemployment claims for independent contractors and the self-employed that “made some private information publicly available for a short time, and worked to immediately remedy the situation,” Pritzker spokeswoman Jordan Abudayyeh said in a statement.
It’s the latest in a series of issues for a beleaguered state agency that has struggled to handle a deluge of unemployment claims as the coronavirus pandemic has ravaged the state’s economy.

The data breach was first reported by WBEZ, Chicago’s public radio station.
Republican state Rep. Terri Bryant issued a news release Saturday night about a “possible massive data breach involving the private information of thousands of Illinois unemployment applicants.”
Click to expand...

guest · May 18, 2020

Colorado’s unemployment system, slammed with coronavirus claims, inadvertently exposed people’s private data
May 18, 2020
https://coloradosun.com/2020/05/18/colorado-unemployment-private-data-released/

Colorado’s computerized unemployment system inadvertently exposed private data of an unknown number of people who had recently filed for unemployment.

The unauthorized access was blamed on a programming error made by the technology vendor. The issue was identified and blocked by the vendor within an hour of when it was noticed on Saturday.
But just in case, the state is offering 12 months of credit monitoring to the 72,000 people on Pandemic Unemployment Assistance, the federal unemployment benefit offered for the first time to gig workers, independent contractors and the self-employed.

She said that it was a technical error by the system’s vendor, Deloitte. Essentially, Deloitte, which provides similar technology to other states, mistakenly gave users privileged functions beyond the role of a regular claimant. t allowed users to search and potentially see another claimant’s “correspondence,” which could include a name and Social Security number.
Click to expand...

guest · May 19, 2020

Arkansas, Illinois COVID-19 unemployment websites leak data
May 19, 2020
https://www.scmagazine.com/website-...ois-covid-19-unemployment-websites-leak-data/

Arkansas and Illinois both reportedly exposed sensitive citizen data after failing to adequately secure web services that the states urgently propped up in order to process applications for the federal Pandemic Unemployment Assistance program.

“While it’s unfortunate, it also should have been expected that in the urgency to rollout out Pandemic Unemployment Assistance to millions of people overnight, there would be inadvertent vulnerabilities,” said Mark Weatherford, chief strategy officer at the National Cybersecurity Center and and a former CISO for the states of California and Colorado.
“Unfortunately, in this case, citizen PII was potentially compromised and now these states will spend hundreds of thousands of dollars in forensics investigations to identify the extent of, and remediate, the damage.”

SC Media reached out to the governor’s offices in both Arkansas and Illinois for additional comment and clarification on what caused the issues.
Click to expand...

“A few months ago, state governments had to quickly launch COVID-related websites in order to get information regarding the pandemic and shelter-in-place orders to their constituents. Sometimes, rushing can lead to cybersecurity vulnerabilities, but without insider insights, it’s hard to say exactly what went wrong in these situations,” said Neill Feather, chief innovation officer at SiteLock.

SiteLock’s own internal data indicates that websites experience an average of 94 attacks per day — up 52 percent from last year. “With double the attacks to defend against, it is increasingly difficult for IT professionals to protect sites from vulnerabilities, especially when working under this time pressure,” added Feather, who warned that cybercriminals will surely be tempted to exploit these state-run sites as they see increased traffic.
Click to expand...

guest · May 21, 2020

Ohioans’ personal info exposed in pandemic unemployment data breach, ODJFS says
May 20, 2020
https://www.fox19.com/2020/05/20/in...mployment-assistance-information-compromised/

The personal information of Ohioans receiving pandemic unemployment assistance was recently exposed to a data breach, according to Ohio Department of Jobs and Family Services.
The information reportedly included names, Social Security numbers and street addresses.

The department says Deloitte Consulting notified it last weekend that around two-dozen people were able “to view other PUA claimants’ correspondence.”
In its release, ODJFS says the people had “accidental access to the system data.”
Click to expand...

ODJFS says Deloitte fixed the breach within an hour, and the department contacted those affected with letters similar to the one referenced above.

“ODJFS holds the confidentiality of claimant data in the highest regard and agreed with the immediate steps Deloitte took to prevent any unauthorized PUA access in the future," the department’s release read.
Click to expand...

guest · May 22, 2020

Florida Unemployment Agency Confirms Data Breach Affecting Some Applicants
May 21, 2020
https://www.baynews9.com/fl/tampa/n...ncy-confirms-data-breach-affecting-applicants

The beleaguered Florida agency handling residents' claims for unemployment confirmed Thursday a data breach had affected some applicants for reemployment assistance.

According to a statement from the Florida Department of Economic Opportunity, people who were affected by what the agency called a "data security incident" have been notified.

"This issue was addressed within 1 hour after we became aware of the incident," the statement reads. "While the incident was handled within 1 hour, in an abundance of caution, we are making available identity protection services at no charge to affected individuals, and we have also advised them to report any unauthorized activity on their financial accounts."
The agency said it had not received any reports of malicious activity related to the breach.
Click to expand...

guest · May 22, 2020

mood said: ↑

Social Security numbers, banking information left unprotected on Arkansas PUA website
May 15, 2020
https://arktimes.com/arkansas-blog/...tion-left-unprotected-on-arkansas-pua-website
Click to expand...

Governor ‘shooting the messenger’ wrong tack in Arkansas PUA data breach, experts say
May 18, 2020
https://arktimes.com/arkansas-blog/...-tact-in-arkansas-pua-data-breach-experts-say

Governor Hutchinson has made expanding computer-science education in Arkansas a top priority of his administration. In December, he announced a Computer Science and Cybersecurity Task Force to enhance cybersecurity education in the state. But in recent days, the governor himself has been out of step with cybersecurity best practices, according to experts.

Beginning on Saturday at a news conference and continuing Monday, Hutchinson has framed the applicant who sounded the alarm as acting illegally. He announced Monday that the FBI was investigating the matter. He said he understood personal information had been “exploited.”

Asked about his rationale for framing the programmer’s actions as illegal, the governor said, “When you go in and manipulate a system in order to gain an access that you’re not allowed to have permission to access, that is a violation of the security that we want to have in place in these systems, and it would be a violation of the law as well, I would think.”
But the programmer didn’t manipulate the security of the system. He was a PUA applicant himself, who gained access to the admin portal by simply altering the website’s URL, which suggests that basic security protocols were lacking or nonexistent.
Click to expand...

guest · May 24, 2020

mood said: ↑

Florida Unemployment Agency Confirms Data Breach Affecting Some Applicants
May 21, 2020
https://www.baynews9.com/fl/tampa/n...ncy-confirms-data-breach-affecting-applicants
Click to expand...

Less than 100 people affected...
Florida's unemployment agency leaked Social Security data last month
May 22, 2020
https://statescoop.com/floridas-unemployment-agency-leaked-social-security-data-last-month/

The Florida Department of Economic Opportunity earlier this month notified 98 residents who’d applied for unemployment insurance that their names and Social Security numbers had been compromised.

The incident is the third such accidental data disclosure by a state unemployment agency to become public in recent days. The Arkansas Division of Workforce Services briefly shut down its unemployment benefits system earlier this month [...] The office of Illinois Gov. J.B. Pritzker also recently announced that a glitch in the state’s new unemployment system “made some private information publicly available for a short time.”

News of Florida’s leak arrives as states across the country rush forward upgrades to their legacy IT systems to meet sudden widespread demand for unemployment assistance.
The national unemployment rate rose to 14.7% last month, with the worst affected states showing figures even higher.
Click to expand...

guest · May 26, 2020

mood said: ↑

Ohioans’ personal info exposed in pandemic unemployment data breach, ODJFS says
May 20, 2020
https://www.fox19.com/2020/05/20/in...mployment-assistance-information-compromised/
Click to expand...

Class-action lawsuit filed against state contractor over ODJFS data leak
May 26, 2020
https://abc6onyourside.com/on-your-...against-state-contractor-over-odjfs-data-leak

A class-action lawsuit has been filed in the Cuyahoga County Court of Common Pleas, alleging Deloitte—the contractor the Ohio Department of Job and Family Services (ODJFS) hired to create and manage the new Pandemic Unemployment Assistance system—acted "negligently and recklessly," leading to last week's data leak.

The lawsuit wants Deloitte to pay out of pocket costs for the about 130,000 Ohioans affected by the leak, as well as damages for stress and anxiety.

"It’s something I have to worry about," Tim Smith, one of three named plaintiffs on the suit, said.
Click to expand...

Marc Dann, a former Ohio Attorney General, is leading the lawsuit. Dann says ODJFS "did the right thing," part of why they are not named a defendant in the suit.
Deloitte is a leader in the field, and part of one of the largest accounting firms in the world, Dann added, having experience with government contracts and creating computer systems.
Click to expand...

guest · May 29, 2020

Kentucky unemployment website experienced April data breach
May 28, 2020
https://www.fox19.com/2020/05/28/kentucky-unemployment-website-experiences-data-breach/

Kentucky officials reported Thursday what Gov. Andy Beshear described as a “data breach” in the state’s unemployment insurance web portal.

The so-called breach took place on April 23, according to a release from Kentucky’s Education and Workforce Development Cabinet.
EWDC says its Office of Technology Services received a report at 9:17 a.m. on that day saying some unemployment insurance claimants could potentially view the identity verification documents uploaded by others.

“There are no indications that the UI system was infiltrated from the outside,” Deputy Secretary Josh Benton said. “This was only a situation that could potentially be viewed by other UI claimants.”
Benton added no additional incidents have been reported and that an ongoing technology investigation has been ongoing since then to make sure the system is secure.
Click to expand...

According to Beshear, EWDC did not believe the vulnerability qualified as a data breach under the law and therefore did not believe it was compelled to disclose it publicly. The governor believes it was a breach.
Click to expand...

guest · Jun 21, 2020

Illinois unemployment data breach leads to ID theft, class-action lawsuit claims
June 18, 2020
https://www.illinoispolicy.org/illi...eads-to-id-theft-class-action-lawsuit-claims/

A data breach that exposed Social Security numbers and other private information of 32,483 Illinois unemployment applicants resulted in at least one case of identity theft, according to a class-action federal lawsuit.

Briana Julius is suing Deloitte Consulting, alleging the contractor failed to secure personally identifying information which led to fraudulent charges on her bank account and her debit card being shut off.
Deloitte was paid $22 million to build and manage the system for the Illinois Department of Employment Security to handle claims from self-employed and gig workers, but soon after the system went online May 11 it was found to be publicly exposing private applicant information.

The class-action suit on behalf of Julius is the third lawsuit against Deloitte for the May data breach. Two groups of Ohio residents also filed lawsuits.
Click to expand...

Colorado also experienced a data breach, officials there said.

“It’s been 12 weeks since I requested assistance and it’s still up in the air. I have not been able to get anything; it’s one roadblock in front of the other,” said Ernie Sandoval, an idled automotive service manager from Mokena, Illinois.

“We need to have more assistance and a better way to help the people of Illinois deal with hard times like this.”
Click to expand...

also mentioned here:
Class action alleges data breach exposed COVID-19 unemployment applicants' personal information

guest · Jul 18, 2020

Arkansas vendor sued over data breach
July 18, 2020
https://www.arkansasonline.com/news/2020/jul/18/state-vendor-sued-over-data-breach/

A lawsuit filed Thursday in Pulaski County Circuit Court says the security breach of a new state computer program this spring led to identity theft of those seeking to apply for unemployment compensation benefits.

The lawsuit claims that Protech Solutions of Little Rock, which was hired by the state to develop the program, was negligent in its work, leading to a breach that compromised banking information and other personal data of applicants. Plaintiffs also claim the breach led to an invasion of privacy.
Congress, with passage in March of the CARES Act as an economic response to the coronavirus pandemic, established the Pandemic Unemployment Assistance program.
Click to expand...

The Division of Workforce Services, which is part of the state Department of Commerce, hired Protech to develop a computer program to collect applications from newly unemployed workers. The state isn't a defendant in the lawsuit, which was assigned to Circuit Judge Alice S. Gray.
In seeking class-action status, the attorneys say some 30,000 applicants could have been affected by the breach. The lawsuit doesn't specify monetary damages being sought.
Click to expand...

guest · Aug 4, 2020

mood said: ↑

Kentucky unemployment website experienced April data breach
May 28, 2020
https://www.fox19.com/2020/05/28/kentucky-unemployment-website-experiences-data-breach/
Click to expand...

Kentucky unemployment system hit by potential data breach, second time in three months
July 29, 2020
https://www.lex18.com/news/covering...ntial-data-breach-second-time-in-three-months

There has been another potential data breach in the state's unemployment system.
The person who reported it said they could see the personal information of someone else who filed an unemployment claim.

"On July 27, 2020, at approximately 4 p.m., the Office of Unemployment Insurance ("OUI")learned that a claimant (Claimant A) had seen information pertaining to another individual (Claimant B) while Claimant A was navigating his own unemployment application in the OUI online system. [...]"
Back in May, during Gov. Andy Beshear's press conference, it was announced that there was a potential data breach of the Unemployment Insurance portal back in April.
Josh Benton with the Department of Education and Workforce Development said at the time there are no indications that the UI system was infiltrated from the outside.
Click to expand...

guest · Sep 21, 2020

Kentucky unemployment breach: Legal misinterpretation to blame for delay in reporting
September 21, 2020
https://eu.courier-journal.com/stor...nterpretation-led-reporting-delay/5765270002/

An inspector general report has found there were "unacceptable" delays in reporting an April security breach of Kentucky's unemployment system but that residents' personal information doesn't appear to have been misused.

The report primarily blames the monthlong delay in reporting the breach on current legal staff who relied on a holdover procedure from the previous administration that misinterpreted state law governing when breaches need to be reported.
Under state law, security breaches are required to be reported within 72 hours.
Click to expand...

The report, completed July 27 and obtained by The Courier Journal via an open records request, concluded there was “significant room for improvement in developing, implementing and communicating clear and consistent policies and procedures” surrounding breaches.

"Communications" show current cabinet staff relied on an old interpretation that the reporting law wasn’t triggered unless there was a determination "as to misuse or likelihood of misuse" of peoples' personal information, the report reads.
Rather, it should have been reported as soon as the benefits claimant said she saw the documents of others.
Click to expand...

guest · Oct 28, 2020

Cyber attack on WI's unemployment system exposes banking information
October 27, 2020
https://www.fox6now.com/news/cyber-attack-on-wis-unemployment-system-exposes-banking-information

The unemployment website said Fischer's money was deposited into a Wells Fargo account. However, Fischer says she has never banked with Wells Fargo.

Fischer later received letters from the state's Department of Workforce Development, which oversees unemployment payments. They said a cyberattack gave an "unknown imposter" access to her bank accounts and personal information.
A spokesperson says the department believes the cyber attack or attacks were able to access 116 active unemployment accounts.
Click to expand...

guest · May 12, 2021

Kansas Identity Theft Spike Could Be Linked to Data Breach
May 11, 2021
https://www.infosecurity-magazine.com/news/kansas-identity-theft-spike/

The state with the highest identity theft rate in the country may have been impacted by a Department of Labor data breach.

According to new data released by the Federal Trade Commission (FTC), the reported rate of identity theft in Kansas in 2020 was higher than that of any other state and more than three times greater than the national average.
Click to expand...

An investigation into a possible breach was launched after a woman named Lisa Hirst accidentally entered the wrong Social Security number into the KDOL website in February and was shown someone else's personal information.

“I can’t be the only one who found this," said Hirst. “I mean, it was so easy to do, and I didn’t even mean to.”
“Now that this information has been brought to light, it actually, it helps me understand what might actually be going on,” said Owens.
Click to expand...

guest · Jul 23, 2021

Hackers expose personal data of 58,000 claiming unemployment benefits in Florida
July 23, 2021
https://www.miamiherald.com/news/local/article252990028.html#storylink=mainstage_card

Hackers targeting Florida’s unemployment website potentially stole the personal data, including Social Security numbers, of nearly 58,000 people.

The Department of Economic Opportunity said Friday that hackers targeted the site, known as CONNECT, between April 27 and July 16 of this year, breaching the personal information of unemployment recipients.
The hackers targeted 57,920 claimant accounts, the department said, and they might have obtained those people’s Social Security numbers, driver’s license numbers, bank account numbers, claim information and other personal details, such as addresses, phone numbers and dates of birth.
Click to expand...

The attack was discovered last week. The department recently started notifying affected Floridians of the breach.
Click to expand...

Log in or Sign up

Data breach in online unemployment system exposes private information

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Data breach in online unemployment system exposes private information

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches