5 ms·

Security incident compromised Washingtonians’ personal information

58 points by aendruk 6y ago

aendruk 6y ago
Notifications to affected people were sent out today.
daotoad 6y ago
I got hit by this. If you did, you really want to close the bank accounts that were exposed and open new accounts. My credit union was very easy to work with on this, but it has still been a pain in the butt. I think we need disposable, single purpose bank account numbers like some services provide for CC transactions. I sure wish I had a fake proxy account ID between my real account and WA state.
- Spooky23 6y ago
  You can do this with savings accounts at most banks, and checking at many others. Most credit unions and online banks let you do it online.
- aneutron 6y ago
  I am always mind-blown when a story like this hits the news: How has a country so technologically advanced like the USA, not yet devised a single federal system where simple citizens can get information about accounts and loans opened in their names. In France (my country), a single inquiry can net you all the information about the accounts opened in your name (which in turn helps you track down any other problem). And then, how have the banking sector over there been forced to take a more procedurally secure approach to banking ?
  - blendergeek 6y ago
    Originally the USA was more akin to the EU than to France. Some here would love to see it become like that once again with more autonomy for the individual states. Because of this we probably won't see a national portal any time soon.
    - aneutron 6y ago
      I'm sorry I answered a similar comment before I saw yours. It's essentially the same comment's essence, hence the same answer.
  - thereare5lights 6y ago
    Because this country has strong traditions of local autonomy and many areas resist federal encroachment.
    - aneutron 6y ago
      I certainly understand this. And it's a tradition I admire. However, a case may be made that some things should be mandated at the federal level. Particularly when it can for example ruin people's lives without their knowledge or will(e.g. Credit scoring, double jeopardy, slavery, even death penalties IMO).
  - watermelon59 6y ago
    Brazil has a similar system called Registrato, run by the central bank. Honestly though, I’m not a fan of such all-encompassing federal systems. I live in the US but I’m in Brazil right now (yes, at the worst possible time for one to be here, but my mom passed away) and I’m appalled at how often I have to give heaps of personal information for the smallest inquiries or purchases. It feels extremely invasive and freedom-averse. I was also shocked at how easily some places could pull all sorts of information on me in just seconds.
LanternLight83 6y ago
Some folks got emails / letter at least three days ago. The third party provider in question is the same secure file transfer provider that lead Kroger to notify it's employees of the breach throughout the past couple weeks.
ziddoap 6y ago
With the breach happening in December 2020, and the State Auditors Office being aware of it on January 12th, I am curious to why the announcement page was not published until February 1st with notifications only being sent out now, over a month later. Seems like a rather sluggish response, unless I am misinterpreting the timeline. Is this a new wave of notifications, or they have just now identified the affected individuals?
saberworks 6y ago
“I want to be clear: This was an attack on a third-party service provider. The Employment Security Department did nothing to cause this, and is not responsible in any way for this incident,” McCarthy said. They've been saying this since it hit the news at least a couple of weeks ago. Don't they bear some responsibility for choosing a crappy 3rd party service? Maybe the lowest bidder? I ran into the same thing with the Kitsap County (also WA) passenger only ferry service ticketing system. They require a ton of personal information but they're using a 3rd party provider to process payments and reservations. Said 3rd party provider has(had?) a very open "privacy" policy (which should be called the "information sharing policy") which basically allowed them to share all the information with whoever they want for any reason. I contacted Kitsap Transit and they just didn't care. They don't see any problem, saying "everybody does that." When I pushed back, they forwarded me an email from the 3rd party where someone there claimed "we don't actually share it." and that was as far as I got. It's such a shame that our own government can't treat personal information with respect.
- mistrial9 6y ago
  you and other citizens are being tracked via "public" transport. USA railways have done this for decades. It is a revolving door to law enforcement and commercial use of that data.
- colonelxc 6y ago
  The gov is absolutely responsible. They chose the vendors, they implicitly (or explicitly) approved their storage policies. The time range for these 'temporarily stored files' was Jan 1 to Dec 10 2020, aka a whole year.
  - Pfhreak 6y ago
    Yes, but it's not sufficient to stop there. We need to ask the five whys -- why did this vendor get chosen? Why were the criteria developed that led to this vendor selection? etc. etc. Yes, they are responsible to their users, but I'm going to guess that they have been put into a tough situation to modernize and increase in scale while also dramatically reducing budgets.
deleted 6y ago
[deleted]
airhead969 6y ago
There ought to be a "HIPAA" bill for PII that only certain, special, accredited companies can hold that class of data. Password hashes, social security numbers, DoB, addresses, phone numbers, bank account no., credit card no. all need to be held back and dispensed very, very carefully and in a limited fashion. Want to have a website with a login? No more individual passwords, only OAuth2 (or similar) SSO using one of the accredited providers. Preferably, there should only be 2-3 providers, all nonprofits, run as public utilities, and heavily audited.
edoceo 6y ago
Similar thing happens to the WSLCB new track-and-trace (Akerna) program after it's bumpy launch in 2018.
natas 6y ago
Pat McCarthy needs to go; under her governance hundreds of millions of dollars went missing, and now, they leaked records of millions of Americans.
throwawaysea 6y ago
Is this a separate incident from the CA and WA unemployment offices getting scammed and making massive payments to Nigerians? Apparently the heads of those agencies somehow left their state level scandals for new positions in the Biden administration: https://www.foxnews.com/opinion/biden-reward-scandal-plagued-agency-leaders-jason-rantz https://www.foxnews.com/opinion/biden-reward-scandal-plagued...
korginator 6y ago
With dozens of high profile attacks via the Accellion FTA vector, I wonder why this is not yet being treated as a crisis, and organizations proactively looking at their use of Accellion's deprecated products. They know it's vulnerable, so they're just sitting around twiddling their thumbs???

58 points by aendruk 6y ago

Notifications to affected people were sent out today.

I got hit by this. If you did, you really want to close the bank accounts that were exposed and open new accounts. My credit union was very easy to work with on this, but it has still been a pain in the butt. I think we need disposable, single purpose bank account numbers like some services provide for CC transactions. I sure wish I had a fake proxy account ID between my real account and WA state.

Spooky23 6y ago
You can do this with savings accounts at most banks, and checking at many others. Most credit unions and online banks let you do it online.
aneutron 6y ago
I am always mind-blown when a story like this hits the news: How has a country so technologically advanced like the USA, not yet devised a single federal system where simple citizens can get information about accounts and loans opened in their names. In France (my country), a single inquiry can net you all the information about the accounts opened in your name (which in turn helps you track down any other problem). And then, how have the banking sector over there been forced to take a more procedurally secure approach to banking ?
- blendergeek 6y ago
  Originally the USA was more akin to the EU than to France. Some here would love to see it become like that once again with more autonomy for the individual states. Because of this we probably won't see a national portal any time soon.
  - aneutron 6y ago
    I'm sorry I answered a similar comment before I saw yours. It's essentially the same comment's essence, hence the same answer.
- thereare5lights 6y ago
  Because this country has strong traditions of local autonomy and many areas resist federal encroachment.
  - aneutron 6y ago
    I certainly understand this. And it's a tradition I admire. However, a case may be made that some things should be mandated at the federal level. Particularly when it can for example ruin people's lives without their knowledge or will(e.g. Credit scoring, double jeopardy, slavery, even death penalties IMO).
- watermelon59 6y ago
  Brazil has a similar system called Registrato, run by the central bank. Honestly though, I’m not a fan of such all-encompassing federal systems. I live in the US but I’m in Brazil right now (yes, at the worst possible time for one to be here, but my mom passed away) and I’m appalled at how often I have to give heaps of personal information for the smallest inquiries or purchases. It feels extremely invasive and freedom-averse. I was also shocked at how easily some places could pull all sorts of information on me in just seconds.

LanternLight83 6y ago

Some folks got emails / letter at least three days ago. The third party provider in question is the same secure file transfer provider that lead Kroger to notify it's employees of the breach throughout the past couple weeks.

ziddoap 6y ago

With the breach happening in December 2020, and the State Auditors Office being aware of it on January 12th, I am curious to why the announcement page was not published until February 1st with notifications only being sent out now, over a month later. Seems like a rather sluggish response, unless I am misinterpreting the timeline. Is this a new wave of notifications, or they have just now identified the affected individuals?

saberworks 6y ago

“I want to be clear: This was an attack on a third-party service provider. The Employment Security Department did nothing to cause this, and is not responsible in any way for this incident,” McCarthy said. They've been saying this since it hit the news at least a couple of weeks ago. Don't they bear some responsibility for choosing a crappy 3rd party service? Maybe the lowest bidder? I ran into the same thing with the Kitsap County (also WA) passenger only ferry service ticketing system. They require a ton of personal information but they're using a 3rd party provider to process payments and reservations. Said 3rd party provider has(had?) a very open "privacy" policy (which should be called the "information sharing policy") which basically allowed them to share all the information with whoever they want for any reason. I contacted Kitsap Transit and they just didn't care. They don't see any problem, saying "everybody does that." When I pushed back, they forwarded me an email from the 3rd party where someone there claimed "we don't actually share it." and that was as far as I got. It's such a shame that our own government can't treat personal information with respect.

mistrial9 6y ago
you and other citizens are being tracked via "public" transport. USA railways have done this for decades. It is a revolving door to law enforcement and commercial use of that data.
colonelxc 6y ago
The gov is absolutely responsible. They chose the vendors, they implicitly (or explicitly) approved their storage policies. The time range for these 'temporarily stored files' was Jan 1 to Dec 10 2020, aka a whole year.
- Pfhreak 6y ago
  Yes, but it's not sufficient to stop there. We need to ask the five whys -- why did this vendor get chosen? Why were the criteria developed that led to this vendor selection? etc. etc. Yes, they are responsible to their users, but I'm going to guess that they have been put into a tough situation to modernize and increase in scale while also dramatically reducing budgets.

deleted 6y ago

[deleted]

airhead969 6y ago

There ought to be a "HIPAA" bill for PII that only certain, special, accredited companies can hold that class of data. Password hashes, social security numbers, DoB, addresses, phone numbers, bank account no., credit card no. all need to be held back and dispensed very, very carefully and in a limited fashion. Want to have a website with a login? No more individual passwords, only OAuth2 (or similar) SSO using one of the accredited providers. Preferably, there should only be 2-3 providers, all nonprofits, run as public utilities, and heavily audited.

edoceo 6y ago

Similar thing happens to the WSLCB new track-and-trace (Akerna) program after it's bumpy launch in 2018.

natas 6y ago

Pat McCarthy needs to go; under her governance hundreds of millions of dollars went missing, and now, they leaked records of millions of Americans.

throwawaysea 6y ago

Is this a separate incident from the CA and WA unemployment offices getting scammed and making massive payments to Nigerians? Apparently the heads of those agencies somehow left their state level scandals for new positions in the Biden administration: https://www.foxnews.com/opinion/biden-reward-scandal-plagued-agency-leaders-jason-rantz https://www.foxnews.com/opinion/biden-reward-scandal-plagued...

korginator 6y ago

With dozens of high profile attacks via the Accellion FTA vector, I wonder why this is not yet being treated as a crisis, and organizations proactively looking at their use of Accellion's deprecated products. They know it's vulnerable, so they're just sitting around twiddling their thumbs???