Washington State Auditor's Office sao.wa.gov Washington State Auditor's Office data breach: what happened and what to do
Hackers exploited Accellion's file-transfer software and reached files held by the Washington State Auditor's Office. About 1.4 million people who filed for unemployment benefits in 2020 were affected. Exposed data included Social Security numbers, driver's license numbers and bank account numbers.
View all 13,177 breaches- Breach date
- 12 Jan 2021
- Made public
- 12 Feb 2021
- Affected
- 1,400,000
- Data exposed
- Social security numbers, Driver's licenses, Bank account numbers, Employment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
The Washington State Auditor's Office used a file-transfer product from Accellion, a roughly 20-year-old tool called FTA, to share files with state agencies. Attackers exploited it, and the office learned on January 12, 2021, after Accellion announced a security problem. It took until early February to learn which files had been accessed. Reports differ on the count: the state described 1.6 million claims involving about 1.4 million people.
The affected people had filed for unemployment benefits between January 1 and December 10, 2020. The auditor held the data while investigating how the state's Employment Security Department lost money to fraudulent claims.
Sources checked: darkreading.com, siliconangle.com, atg.wa.gov
Last verified against the official page:
What was exposed
The files contained Social Security numbers, driver's license numbers, bank account numbers and employment information. That mix lets criminals try to open credit, redirect benefits or file false tax returns. Unemployment fraud was already widespread in 2020, so people in this group have extra reason to watch for claims filed in their name.
Who else was in the data
The auditor's office also reported personal information held by the Department of Children, Youth and Families, plus non-personal financial data from about 100 local governments and 25 other state agencies.
What to do if you were in it
- 1
Freeze your credit
Place a free credit freeze at Equifax, Experian and TransUnion, as the FTC advises when a Social Security number may be exposed. Then check your reports at annualcreditreport.com for accounts you don't recognize.
- 2
Check for unemployment claims you didn't file
If you get a benefits letter or a tax form for unemployment you never claimed, report it at IdentityTheft.gov and to your state's unemployment agency.
- 3
Watch your bank account
Bank account numbers were among the data. Check statements for transfers you don't recognize, and ask your bank if you should get a new account number.
- 4
Be wary of messages that mention the breach
Scammers write to people named in a breach. Don't click links or call numbers in an unexpected email, text or letter; go to the organization's own website or phone number instead.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details and alerts you when they show up in a new leak.
Official filings
- Washington Attorney General , filed 12 Feb 2021 : 1,420,520 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the Washington State Auditor's Office breach?
You were likely included if you filed for unemployment benefits in Washington between January 1 and December 10, 2020. The state sent notices to affected people.
What was exposed?
Social Security numbers, driver's license numbers, bank account numbers and employment information, according to news reports of the state's disclosure.
Should I freeze my credit?
Yes, if your Social Security number was in the data. A freeze is free at Equifax, Experian and TransUnion, and the FTC says it blocks most new accounts in your name.
Sources
- darkreading.com/application-security/data-on-1-4-million-washington-state-residents-breached
- siliconangle.com/2021/02/01/1-4m-unemployment-records-stolen-washington-state-data-breach/
- atg.wa.gov/data-breach-notifications
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
