Data breaches are no surprise these days. I have covered a number of data breaches here on the Bach Seat here, here, and here. Now the State of Michigan (SOM) has joined the ranks of data leakers like Yahoo, Home Depot, Target, BCBS, and the US government. MLive is reporting that the State of Michigan has spilled the personal data of millions of Michigan citizens. On February 03, 2017, the Michigan Department of Technology Management and Budget (DTMB) announced the Michigan data breach. The breach leaked the Personal information of nearly 20% of Michigan residents who were vulnerable to unauthorized access for four months.
Unemployment Insurance Agency
The article reports that in October 2016, a software update to the Michigan Data Automated System (MiDAS) system was used by the state’s Unemployment Insurance Agency (UIA). MiDAS was created by Fast Enterprises of Centennial, CO, and went live in 2012 as part of a modernization of the unemployment benefits and tax system. A flaw allowed employers and human resources firms to get access to names and social security numbers of nearly 1.9 million Michigan residents they were not authorized to view.
The state identified the Michigan data breach on Jan. 30 and fixed it on Jan. 31, 2017. Contracted payroll service providers had unauthorized access to the MiDAS system, according to UIA spokesperson Dave Murray. Anybody working for a company that uses one of those payroll service providers may have had their personal information compromised. DTMB official Caleb Buhs warned, “If you are an employee in Michigan and your company uses a payroll vendor to process payroll, then you can potentially be included.”
Impacted by the Michigan data breach
According to a report on MLive, the 31 vendors with unauthorized access to Michigan citizens’ PII included:
- 7-Eleven
- Aatrix
- Accountants World
- Acrisure
- ADP
- Benepay
- Casper Willson Wilson
- Computing Resources
- Connectpay LLC
- CoStaff National Services Inc
- Craft Accounting
- CSS Payroll Inc
- DTMB
- DM Payroll
- Dominion Systems
- GT Independence
- Heins Acctg
- Hewitt Assoc
- Highpoint Business Services LLC
- Infiniti HR LLC
- Julie Lepper Acctg
- Mercantile Bank
- My Pay Solutions
- Nieland & Kosanke PC
- One Source Virtual
- Paychex
- Paycomm Payroll LLC
- Paycor
- Paylocity Corp
- Payroll 1
- Payroll Tax Mgt
- Professional Systems
- Ultimate Software
- VenSure HR Inc
- Wayne County Regional
- Zen Payroll
DTMB Director and State CIO David Behen stated, “Data security is a top priority for the state of Michigan … We will work with our third-party vendors and our state team to check our processes and procedures to avoid incidents like this in the future.”
Recommendations
Here’s what the SOM is recommending those who may have had their PII exposed do:
- Call the state hotline at 855-707-8387 between 8 a.m. and 4 p.m. on weekdays to make inquiries about this issue.
- Monitor financial account statements and immediately report any suspicious or unusual activity to financial institutions.
- Request a free credit report at www.AnnualCreditReport.com or by calling 1-877-322-8228. Consumers are entitled by law to one free credit report per year from each of the three major credit bureaus – Equifax, Experian, and TransUnion – for a total of three reports every year. Contact information for the credit bureaus can be found on the Federal Trade Commission.
- Take steps to monitor their personally identifiable information and report any suspected instances of identity theft to their local law enforcement.
MiDAS has been in the news before. MiDAS’ “robo-adjudication” feature wrongly flagged at least 20,000 people for unemployment fraud between October 2013 and August 2015. MiDAS would automatically flag a discrepancy and send a message to a seldom-used internal unemployment system. When the victims didn’t respond, the system would automatically find they had committed fraud and issue a 400% fine.
rb-
The way data breach report work is that the originating firm under-estimates the number of records lost by half. So it is possible that the SOM has released nearly 4 million or 38% of all Michiganders personal records.
Despite the Michigan State Police Cyber Command being on the job, it is likely that nothing will happen to the perpetrators – nothing ever does. DTMB spokesman Buhs said, “We are learning from this.” I hope so.
Related articles
- Equifax, TransUnion Fined for Deceptive Credit Score Marketing (thesimpledollar.com)
Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.
