ArbiterSports arbitersports.com ArbiterSports data breach: what happened and what to do
ArbiterSports, which runs scheduling for sports officials, said an unauthorized party took a backup copy of a database in the weeks before July 15, 2020. Reports put it at more than 500,000 accounts. Passwords were encrypted, but the notice says the party could decrypt them.
View all 13,177 breaches- Breach date
- 3 Jun 2020
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Arbiter (ArbiterSports) provides assignment and payment software for referees and other sports officials. Its notice says it detected unauthorized access to certain devices on its network and an attempt to encrypt its systems. It stopped the encryption, but found that a backup copy of a database, kept for business continuity, had been obtained by the unauthorized party in the weeks before July 15, 2020. The Indiana Attorney General's listing gives June 3, 2020 as the start date.
The unauthorized party demanded payment to delete the files. Arbiter says it reached an agreement and received confirmation that the files were deleted.
Sources checked: oag.ca.gov, dojmt.gov, soccerwire.com
Last verified against the official page:
How many people
News outlets reported more than 500,000 referee and sports accounts. State filings show much smaller numbers for individual states, such as the Washington filing, which only counts Washington residents.
What was exposed
Reports describe usernames, passwords, names, addresses, birthdates, email addresses and Social Security numbers. Arbiter's notice says the passwords and Social Security numbers in the file were encrypted, but that the party was able to decrypt them.
The company's response
Arbiter offered affected users one year of Experian IdentityWorks credit monitoring and told people to reset their passwords if they had not done so since July 14, 2020.
What to do if you were in it
- 1
Change your Arbiter password and any reuse of it
Change it on Arbiter, then on every other account that shares it. Use a unique password for each site, and turn on two-factor login where it's offered.
- 2
Freeze your credit at all three bureaus
A credit freeze is free and stops lenders from seeing your credit report, which blocks most new accounts in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains. Do this if you have an Arbiter account tied to a Social Security number.
- 3
Take the offered credit monitoring
Arbiter's notice offers one year of Experian IdentityWorks. Monitoring alerts you to new activity but doesn't block it, so pair it with a freeze.
- 4
Treat messages that mention the breach as suspect
Scammers quote real breach details to look legitimate. Don't click links or call numbers in unexpected messages. Go to the company's website yourself, and see the FTC's phishing guide.
- 5
Report misuse at IdentityTheft.gov
If someone opens an account or files a return in your name, report it at IdentityTheft.gov and follow the recovery plan it gives you.
Official filings
- Washington Attorney General , filed 24 Aug 2020 : 16,465 people
Timeline
-
The breach happened
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the ArbiterSports breach?
If you held an account as a referee, official or school or league contact, possibly. Arbiter sent notices to affected users.
Should I change my password?
Yes, if you haven't since July 14, 2020, and change it anywhere you reused it. Arbiter's notice says passwords were decryptable by the party that took the file.
Did Arbiter pay the ransom?
Its notice says it reached an agreement with the unauthorized party and received confirmation the files were deleted. Files can't be guaranteed gone, so protect yourself as if they might not be.
Sources
- oag.ca.gov/system/files/Arbiter%20-%20California%20Notification.pdf
- dojmt.gov/wp-content/uploads/Arbiter-Consumer-ltr.pdf
- soccerwire.com/news/over-500000-referee-and-sports-accounts-reportedly-exposed-in-hack-of-arbitersports/
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
- consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams
Something wrong or out of date? Tell us and we'll re-check it.
