Mainegov MOVEit Global Security Incident

pHealing Together Supporting Victims and Families of the Tragedy in LewistonppInformation for Maine Residents and Impacted IndividualsppMaine encourages individuals to take steps to protect their personal informationppWe are sharing information relating to a cyber incident that exploited a vulnerability in a widely used file transfer tool MOVEit which is owned by Progress Software This event has had a global impact affecting thousands of organizations including certain agencies in the State of Maine While impacted individuals may receive notice of this incident separately we are sharing details broadly on our website Please visit this website for the latest updates relating to this incidentppOn May 31 2023 the State of Maine became aware of a software vulnerability in MOVEit a thirdparty file transfer tool owned by Progress Software and used by thousands of entities worldwide to send and receive data The software vulnerability was exploited by a group of cybercriminals and allowed them to access and download files belonging to certain agencies in the State of Maine between May 28 2023 and May 29 2023ppImportantly as it pertains to the State this incident was specific and limited to Maines MOVEit server and did not impact any other State networks or systemsppSince the onset of the incident the cybercriminals involved claimed their primary targets were businesses with a promise to erase data obtained from certain entities including governments Despite their assertions that any data obtained from government has been erased the State is urging individuals to take steps to protect their personal informationppThe State of Maine has determined that this incident has impacted approximately 13 million individuals with the type of data affected differing from person to person The State encourages individuals to reach out to its dedicated call center to verify if they were affected and if so to identify what specific data of theirs was involvedppThe State of Maine may hold information about individuals for various reasons such as residency employment or interaction with a state agency The State also engages in data sharing agreements with other organizations to enhance the services it provides to its residents and the publicppThe specific information involved in this incident varies based on the individual and their association with the State However the following types of information may have been involved name Social Security number SSN date of birth drivers licensestate identification number and taxpayer identification number In addition for some individuals certain types of medical information and health insurance information may be involvedppBack to topppThe State of Maine carried out an extensive evaluation to identify the individuals whose information may have been impacted This thorough assessment was a critical component of Maines response as it facilitated the State in providing notifications to those who may have been affected This assessment of the impacted files was recently completed and as a result the State is now actively notifying the impacted individuals through various communication channels including through a nationwide media press release letter mail andor emailppBack to topppAs soon as the State became aware of the incident the State took steps to secure its information including by blocking internet access to and from the MOVEit server The State also implemented security measures recommended by Progress Software engaged the services of outside legal counsel engaged external cybersecurity experts to investigate the nature and scope of the incident and conducted an extensive investigation to determine what information was involvedppThe State of Maine is also offering two years of complimentary credit monitoring and identity theft protection services to individuals whose Social Security numbers or taxpayer identification numbers were involvedppBack to topppIndividuals are encouraged to contact Maines dedicated call center to find out if their data was involved or if they have questions about this incident The phone number is 877 6183659 with representatives available from Monday to Friday 9 AM to 9 PM ET If it is determined that an individuals Social Security number or taxpayer identification number is involved the call center will provide the individual with a complimentary credit monitoring codeppIndividuals who receive a code for credit monitoring may enroll in the services by calling 866 6229303 Representatives are there to assist you from Monday to Friday 8 AM to 11 PM ET and on Saturday from 9 AM to 6 PM ETppAdults may also enroll online by visiting httpsappidentitydefensecomenrollmentactivatestme Minors may be enrolled online by visiting httpsappminordefensecomenrollmentactivatestemd Remember to have your code handy when youre ready to enrollppThe State of Maine is also actively notifying impacted individuals through various communication channels including through a nationwide media press release letter mail andor emailppBack to topppThe State DepartmentsAgenciesDivisions listed below were affected by the incident to varying degreesppThe impacted State DepartmentsAgenciesDivisions along with the Divisions percentage range of the impacted individuals are listed below This information is subject to change if new information is learnedppSome State DepartmentsAgenciesDivisions including Maine Revenue Services Center for Disease Control Prevention and Department of Public Safety Gambling Control Unit had fewer than 10 individuals impacted by the incidentppBack to topppWe recommend all individuals take steps to protect their personal information includingppWe encourage you to remain vigilant by regularly reviewing your accounts and monitoring credit reports for suspicious activityppIf you are a US resident you are entitled under US law to one free credit report annually from each of the three nationwide consumer reporting agencies To order your free credit report visit httpswwwannualcreditreportcom or call tollfree at 18773228228 If you discover information on your credit report arising from a fraudulent transaction you should request that the credit reporting agency delete that information from your credit report file Contact information for the nationwide credit reporting agencies is provided in the next sectionppYou may contact the Federal Trade Commission FTC your states Attorney Generals office or law enforcement to report incidents of identity theft or to learn about steps you can take to protect yourself from identity theft To learn more you can go to the FTCs websites at wwwidentitytheftgov and wwwftcgovidtheft call the FTC at 877 IDTHEFT 4384338 or write to FTC Consumer Response Center 600 Pennsylvania Avenue NW Washington DC 20580ppYou may contact the consumer reporting agencies atppYou have rights pursuant to the Fair Credit Reporting Act such as the right to be told if information in your credit file has been used against you the right to know what is in your credit file the right to ask for your credit score and the right to dispute incomplete or inaccurate information Further pursuant to the Fair Credit Reporting Act the consumer reporting agencies must correct or delete inaccurate incomplete or unverifiable information consumer reporting agencies may not report outdated negative information access to your file is limited you must give your consent for credit reports to be provided to employers you may limit prescreened offers of credit and insurance you get based on information in your credit report and you may seek damages from violators You may have additional rights under the Fair Credit Reporting Act not summarized hereppIdentity theft victims and activeduty military personnel have specific additional rights pursuant to the Fair Credit Reporting Act We encourage you to review your rights pursuant to the Fair Credit Reporting Act by i visiting httpsfilesconsumerfinancegovfdocumentsbcfpconsumerrightssummary201809pdf PDF or ii by writing to Consumer Financial Protection Bureau 1700 G Street NW Washington DC 20552ppYou may obtain additional information from the FTC and the credit reporting agencies about fraud alerts and security freezes You can add a fraud alert to your credit report file to help protect your credit information A fraud alert can make it more difficult for someone to get credit in your name because it tells creditors to follow certain procedures to protect you but it also may delay your ability to obtain credit You may place a fraud alert in your file by calling just one of the three nationwide credit reporting agencies listed above As soon as that agency processes your fraud alert it will notify the other two agencies which then must also place fraud alerts in your fileppTo place a fraud alert call any one of the three major credit bureaus at the numbers listed below As soon as one credit bureau confirms your fraud alert they will notify the othersppIf you are very concerned about becoming a victim of fraud or identity theft you may request a Security Freeze be placed on your credit file at no charge A security freeze prohibits with certain specific exceptions the consumer reporting agencies from releasing your credit report or any information from it without your express authorization You may place a security freeze on your credit report by contacting all three nationwide credit reporting companies at the numbers below and following the stated directions or by sending a request in writing by mail to all three credit reporting companiesppIn order to place the security freeze you will need to supply your name address date of birth Social Security number and other personal information After receiving your freeze request each credit reporting company will send you a confirmation letter containing a unique PIN personal identification number or password Keep the PIN or password in a safe place You will need it if you choose to lift the freezeppIf your personal information has been used to file a false tax return to open an account or to attempt to open an account in your name or to commit fraud or other crimes against you you may file a police report in the City in which you currently resideppIf you do place a security freeze prior to enrolling in the credit monitoring service as described above you will need to remove the freeze in order to sign up for the credit monitoring service After you sign up for the credit monitoring service you may refreeze your credit fileppBack to topppIndividuals are encouraged to contact Maines dedicated call center to find out if their data was involved or if they have questions about this incident The phone number is 877 6183659 with representatives available from Monday to Friday 9 AM to 9 PM ET If it is determined that an individuals Social Security number or taxpayer identification number is involved the call center will provide the individual with a complimentary credit monitoring codeppIndividuals who receive a code for credit monitoring may enroll in the services by calling 866 6229303 Representatives are there to assist you from Monday to Friday 8 AM to 11 PM ET and on Saturday from 9 AM to 6 PM ETppAdults may also enroll online by visiting httpsappidentitydefensecomenrollmentactivatestme Minors may be enrolled online by visiting httpsappminordefensecomenrollmentactivatestemd Remember to have your code handy when youre ready to enrollppThe State will keep this dedicated website up to date with the latest information relating to this incident We encourage you to visit frequentlyppView the official press release here PDFppBack to topppView the official press release here PDFppCopyright 2023 All rights reservedp