Maine cyberattack puts 1.3 million people at risk of having information stolen

Roughly 1.3 million people who have interacted with Maine state government or offices may have had personal information hacked, in the latest cyberattack involving MOVEit software and a Russian ransomware gang.

Officials on Thursday said the file transfer tool, owned by Progress Software, had allowed cybercriminals to exploit a vulnerability in the program and download data. The state discovered the incident May 31 and described it as part of a global attack that has affected thousands of organizations in government, insurance, finance, education and health care.

The state recently completed its assessment of the attack, and is now notifying individuals whose information may be compromised.

Specific information at risk depends on how an individual has contacted state offices. However, the types of information that may have been accessed include names, Social Security numbers, birth dates, driver’s license numbers, state identification numbers and taxpayer identification numbers. In addition, for some individuals, certain types of medical data and health insurance records may be involved.

"Since the onset of the incident, the cybercriminals involved claimed their primary targets were businesses, with a promise to erase data from certain entities, including governments," a news release from the Maine Department of Administrative and Financial Services said.

"Despite their assertions that any data obtained from governments has been erased, the State is urging individuals to take steps to protect their personal information."

The MOVEit software vulnerability has been associated with previous hacks believed to be launched by a Russian cyber-extortion gang, according the Department of Homeland Security and reports by the Associated Press and other news media.

The state of Maine has set up a website with more information about the incident, and is offering two years of complimentary credit monitoring and identity theft protection services to people whose Social Security numbers or taxpayer identification numbers were involved.

Individuals are encouraged to contact Maine's dedicated call center to find out if their data was compromised or if they have questions about the incident. The phone number is 877-618-3659, with representatives available from Monday to Friday, 9 a.m. to 9 p.m.