About 21,000 Minnesotans' personal information could have been leaked in a data breach earlier this year, the Minnesota Department of Human Services (DHS) said Friday.
The state agency first notified people who were affected this week, although the data breach occurred in June and July after hackers were able to access two employees' e-mail accounts through phishing campaigns.
"We sincerely regret these data security incidents and apologize for any impact they may have on you or your family," Commissioner Emily Piper wrote in a letter to those affected.
The agency said there's no evidence that personal information was viewed, downloaded or misused, but hackers could have had access to names, birth dates, Social Security numbers, addresses and telephone numbers.
It's the latest cyberattack on Minnesota's state agencies, which fend off about 3 million hacking attempts daily, state officials have said. In fact, attacks are increasing, said Aaron Call, the chief information security officer for Minnesota IT Services, which provides technology services to state executive agencies.
In just the past nine months, more than 700 security incidents have been reported affecting state agencies, Call said, adding that the attacks are becoming "more pervasive and more sophisticated."
"We've had a massive uptick in these phishing incidents in the last several months," he said.
While the DHS said its data breach happened June 28 and July 9, Minnesota IT Services didn't notify the department of the breach until Aug. 13. A DHS spokesperson said Friday that the agency has to report breaches no later than 60 days after it learns of an incident. Under a state law adopted several years ago, companies and government agencies are required to notify consumers of all data breaches.
