The Connecticut Department of Children and Families says it is investigating a "sophisticated phishing email" that appears to have downloaded emails from two DCF accounts.
According to the State's statement, the same day, May 20, the Department of Administrative Services expelled the cyber attacker from State systems.
To further contain the situation and minimize additional risk, DCF and DAS report the malicious email was proactively removed from all users’ inboxes across the agency. The compromised accounts were also temporarily disabled to safeguard user information and preserve the integrity of State data and systems, the statement adds.
A review continues to determine how much "personal information," per Connecticut law, was leaked in the breach.
The State says it is in the process of identifying and notifying those individuals who were impacted and will be offering credit monitoring and identity theft protection services to those found to have had their Social Security Numbers compromised.
The State of Connecticut reports it has made appropriate referrals to law enforcement.
DCF adds that it is working with DAS and the Office of the Attorney General to ensure compliance with all applicable statutory notice requirements related to the compromised information.
