SACRAMENTO, Calif. (AP) — The country's largest public pension fund says
the personal information of about 769,000 retired California employees and other beneficiaries — including Social Security numbers — was among data
stolen by Russian cybercriminals in the breach of a popular file-transfer application.
It blamed the breach on a third-party vendor that verifies deaths. The
same vendor, PBI Research Services/Berwyn Group, also lost the personal
data of at least 2.5 million Genworth Financial policyholders, including
Social Security numbers, to the same criminal gang, according to the
Fortune 500 insurer.
The California Public Employees Retirement system said they were offering affected members two years of free credit monitoring. Genworth said in a statement posted online it would offer credit monitoring and ID theft protection.
The breach of the MOVEit file-transfer program, discovered last month, is estimated by cybersecurity experts to have compromised hundreds of organizations globally. Confirmed victims include the U.S. Department of
Energy and several other federal agencies, more than 9 million motorists
in Oregon and Louisiana, Johns Hopkins University, Ernst & Young, the BBC
and British Airways.
The criminal gang behind the hack, known as Cl0p, is extorting victims, threatening to dump their data online if they don't pay up.
Genworth disclosed the hack Thursday of the MOVEit instance managed by PBI Research in a filing with the Securities and Exchange Commission.
Minnesota-based PBI Research did not immediately return a phone message
seeking details on which of its other customers may have been affected.
The company's website lists the Nevada, New Jersey and Tennessee public
pension funds as among customers of its mortality verification service.
“This external breach of information is inexcusable,” CalPERS CEO Marcie
Frost said in a news release. “Our members deserve better. As soon as we learned about what happened, we took fast action to protect our members’ financial interests, as well as steps to ensure long-term protections.”
CalPERS had more than $442 billion in assets as of Dec. 31 and about 1.5 million members.
Security experts say such so-called supply-chain hacks expose an
uncomfortable truth about the software organizations use: Network security
is only as strong as the weakest digital link in the ecosystem.
The stolen data included names, birth dates and Social Security numbers —
and might also include names of spouses or domestic partners and children, officials said. CalPERS planned to send letters Thursday to those affected
by the breach.
CalPERS said PBI notified it of the breach on June 6, the same day cybersecurity firms began to issue reports on the breach of MOVEit, whose maker, Ipswitch, is owned by Progress Software.
PBI reported the breach to federal law enforcement, and CalPERS placed “additional safeguards” to protect the information of retirees who use the member benefits website and visit a regional office, officials said. The
agency did not elaborate on those safeguards, citing security reasons.
This story has been corrected to reflect that Genworth disclosed the hack
on Thursday, not June 16.