California pension officials say personal information of about 769,000 retired state employees and other beneficiaries — including Social Security numbers — was among data stolen by Russian cybercriminals in the breach of a popular file-transfer application.
They said they were offering impacted members two years of free credit monitoring.
The breach of the MOVEit program, discovered last month, is estimated by cybersecurity experts to have compromised hundreds of organizations globally. Confirmed victims include the U.S. Department of Energy and several other federal agencies, more than 9 million motorists in Oregon and Louisiana, Johns Hopkins University, Ernst & Young, the BBC and British Airways.
The criminal gang behind the hack, known as Cl0p, is extorting victims, threatening to dump their data online if they don't pay up.
The California Public Employees' Retirement System said in a statement that a third-party vendor was breached that used MOVEit to help inform it of member deaths and validate payment eligibility.
“This external breach of information is inexcusable,” CalPERS CEO Marcie Frost was quoted as saying. “Our members deserve better. As soon as we learned about what happened, we took fast action to protect our members’ financial interests, as well as steps to ensure long-term protections.”
CalPERS is the largest public pension fund in the United States, with more than $442 billion in assets as of Dec. 31 and about 1.5 million members.
Security experts say such so-called supply-chain hacks expose an uncomfortable truth about the software organizations use: Network security is only as strong as the weakest digital link in the ecosystem.
The stolen data included names, birth dates and Social Security numbers — and might also include names of spouses or domestic partners and children, officials said. It identified the vendor as PBI Research Services/Berwyn Group. CalPERS planned to send letters Thursday to those affected by the breach.
CalPERS said PBI notified it of the breach on June 6, the same day cybersecurity firms began to issue reports on the breach of MOVEit, whose maker, Ipswitch, is owned by Progress Software.
PBI reported the breach to federal law enforcement, and CalPERS placed “additional safeguards” to protect the information of retirees who use the member benefits website and visit a regional office, officials said.
