Share
SACRAMENTO — California pension officials say personal information of about 769,000 retired state employees and other beneficiaries — including Social Security numbers — was among data stolen by Russian cybercriminals in the breach of a popular file-transfer application.
They said they were offering impacted members two years of free credit monitoring.
The breach of the MOVEit program, discovered last month, is estimated by cybersecurity experts to have compromised hundreds of organizations globally. Confirmed victims include the U.S. Department of Energy and several other federal agencies, more than 9 million motorists in Oregon and Louisiana, Johns Hopkins University, Ernst & Young, the BBC and British Airways.
The criminal gang behind the hack, known as Cl0p, is extorting victims, threatening to dump their data online if they don’t pay up.
The California Public Employees’ Retirement System said in a statement that a third-party vendor was breached that used MOVEit to help inform it of member deaths and validate payment eligibility.
“This external breach of information is inexcusable,” CalPERS CEO Marcie Frost was quoted as saying. “Our members deserve better. As soon as we learned about what happened, we took fast action to protect our members’ financial interests, as well as steps to ensure long-term protections.”
Security experts say such so-called supply-chain hacks expose an uncomfortable truth about the software organizations: Network security is only as strong as the weakest digital link in the ecosystem.
The stolen data included names, birth dates and Social Security numbers — and might also include names of spouses or domestic partners and children, officials said. It identified the vendor as PBI Research Services/Berwyn Group. CalPERS planned to send letters Thursday to those affected by the breach.
CalPERS said PBI notified it of the breach on June 6, the same day cybersecurity firms began to issue reports on the breach of MOVEit, whose maker Ipswitch is owned by Progress Software.
PBI reported the breach to federal law enforcement, and CalPERS placed “additional safeguards” to protect the information of retirees who use the member benefits website and visit a regional office, officials said.
RELATED TOPICS:
CA Has Seen Many New Towns, but This Big Project Is Stalled
2 hours ago
Fresno Man Sentenced to 29 Years for Sexually Assaulting Children and Dog
14 hours ago
Bulldogs’ Two-Position Standout Tommy Hopfe Signs With Rockies
14 hours ago
Former Bulldog QB Jake Haener: I Have a ‘Rare Form of Skin Cancer’
15 hours ago
The Many Names of GOP Vice Presidential Nominee JD Vance
15 hours ago
Jack Black, a Small Dog With a Big Heart, Is Looking for His Forever Home