A state agency, two educational institutions, and a grocery chain fell victim to a wave of separate data breaches that swept the southern states and California.
The Palm Beach County Health Department, Randolph College, Lamar County School District, and Bristol Farms all felt the heat of cyberattacks.
On April 11, the Palm Beach County Health Department announced that cybercriminals used an unknown method to breach its systems and compromise the information of more than 1,000 people.
The Department of Justice informed the state agency in February 2016 that it had obtained a list of names, birth dates, social security numbers, Medicaid numbers, phone numbers, and medical record numbers of people who were identified as Palm Beach County Health Department clients, Florida Department of Health spokesperson Tim O'Connor told SCMagazine.com.
O'Connor said he doesn't know how the list was obtained but explained that those affected have been notified and instructed on how to obtain free credit monitoring services.
In a separate attack, a potential data breach at a third-party firm led to 103 Randolph College employees, as of April, 11, reporting cases of identity theft and fraudulent tax returns.
An investigation revealed that the school's networks hadn't been compromised and police believe the attackers used data stolen from a major data breach that occurred earlier to gain access to Greenshades Software, the company the school used to handle online W-2s, the college's Director of College Relations Brenda Edson told SCMagazine.com via emailed comments.
"We believe the information from the W2s was then used to file fraudulent tax returns,” Edson said.
Greenshades Software Co-Chief Executive Officer Matthew Kane refuted the claims.
Kane told SCMagazine.com via emailed comments, "there is no evidence that any network vulnerability has been misused to access employee personal information. There is no evidence of access to any employee account on Greenshades' network without use of valid login credentials."
He went on to say that his company is working with customers to address the situation.
Authorities determined a large number of the IP addresses that had accessed the victims' online W-2 information were registered in foreign countries.
“The College has been working closely with the Lynchburg Police Department, FBI, and Attorney General's Office to identify those responsible,” Edson said.
Edson said many of the victims affected by the previous breach already qualified for free credit monitoring and anyone who hasn't signed up is encouraged to do so.
In other news, employees at another southern educational facility were also impacted by the actions of cybercriminals looking to steal tax data.
Earlier this month, a security breach at INNOVAK, a company that allows employees to access paystubs and W-2 data, lead to the compromise of personal information of Lamar County School District employees and has also affected several school districts in Mississippi and Alabama.
“There are approximately 28 staff members directly affected, but I chose to notify the entire school district,” Lamar Superintendent Tess Smith told SCMagazine.com via emailed comments.
Smith said the breach accessed W-2 information and that INNOVAK has locked down its online portal and has since put safety measures into place.
She said the Federal Bureau of Investigation and the International Revenue Service have been notified and are working to resolve the issue.
SCMagazine.com attempted to contact INNOVAK for comment but had not received a response by press time.
In other news, cybercriminals used spearphishing tactics on a West Coast grocery in order to obtain valuable information.
On March 30, 2016, a scammer posed as a Bristol Farms/Lazy Acres executive and requested information containing employee, names, addresses, Social Security numbers, and 2015 compensation and deduction information, according to an April 8 data breach notification filed with the California Attorney General's office.
The company said that it has alerted those affected and is offering two years of complimentary identity protection.
Law enforcement also has been notified of the breach but it remains unclear how many people were affected.
