Clients of county social service programs in 18 Minnesota counties may have had sensitive information stolen, including Social Security numbers, Clay County officials said Monday.

In a notice of the data breach posted to its website Friday, Clay County said it determined in October that data was taken in a ransomware attack on a Clay County electronic document management system it hosts for many other Minnesota counties. An investigation found clients' Social Security numbers, addresses, birth dates, service information and insurance information may have been affected.

Clay County said it is not aware any personal information from the attack has been released or sold. The county said it is taking steps to enhance security in the wake of the incident.

Clay County said it notified anyone affected for whom it had sufficient contact information via mail in December and again last week. Anyone concerned that they might be affected can call (800) 459-5922 and give the reference number B114604 for more information.

In an email, a Clay County spokesperson listed the following county services agencies that use the system affected by the data breach:

  • Becker County Human Services
  • Big Stone County Family Services
  • Clay County Social Services
  • Isanti County Health and Human Services Division
  • Kittson County Social Services
  • Mahnomen County Social Services
  • Marshall County Social Services
  • Otter Tail County Human Services
  • Pennington County Human Services
  • Polk County Social Services
  • Red Lake County Social Services
  • Roseau County Social Services
  • Scott County Health and Human Services
  • Stevens County Human Services
  • Traverse County Social Services
  • Western Prairie Human Services (serving Grant and Pope counties)
  • Wilkin County Health & Human Services

Many affected counties have posted notices on their websites. Clay County urged anyone potentially affected to review account statements, credit reports and health insurance documents for suspicious activity and report it to authorities.

The county spokesperson said there have been no developments in the incident since the notice was posted to the county website Friday.