Mainers are waking up this morning to news of a massive data breach that, according to the Nov. 9 notice filed with the Maine Attorney General’s office, has affected 1.3 million people. The breach is reported to be the result of a ransomware attack that took advantage of a vulnerability in third-party software used to transfer files (MOVEit.)

Discovered in May, 2023, the breach is believed to be the work of a Russian gang and publicly reported yesterday after a months-long assessment. Of the total affected, 534,194 are residents of Maine, the remainder are non-residents whose information was retained.

In its announcement, the state advised, “Assessment of the impacted files was recently completed, and the State is actively notifying the … individuals through various communication channels, including through a nationwide media press release, letter mail and/or email.”

According to the announcement, more than 50 percent of the information came from records held by the Maine Department of Health and Human Services, an additional 10 – 30 percent is from the Maine Department of Education. Other agencies were involved to a lesser extent. The state reports that names, Social Security numbers, birth dates and driver’s licenses are among the information that may have been accessed.

If my information was breached, what should I do?

1.Call the 3 credit bureaus and immediately place a security freeze on your credit reports:

• Equifax Security Freeze 1-800-349-9960
• Experian Security Freeze 1-888-397-3742
• TransUnion Security Freeze 1-888-909-8872
  
  

There is no charge for the freeze. You will be sent a letter with a personal identification number- PIN or password. Keep it somewhere that is safe so you can use it if you need to remove or list the freeze.

If a child’s information was stolen, make sure that you place a freeze on their credit reports as well. Children’s information is highly valued by identity thieves because the theft isn’t usually discovered until the child becomes an adult and applies for credit.

2. Order copies of your credit reports to review from The Federal Trade Commission’s officially-recognized provider for your free credit reports: 1-877-322-8228.

3.Carefully monitor your accounts and your credit reports for unusual activity. If your information is fraudulently used, notify local law enforcement. You will need to make a report and keep a copy of the report to dispute any fraudulent financial transactions.

4. Credit monitoring is being offered for those who received notification letters. If you wish to have credit monitoring services, you will need to temporarily lift the freeze on your credit reports and reinstate it.

5. If your social security number or date of birth was exposed, contact the Social Security Administration immediately at either their toll free main number (1-800-772-1213.) Explain that your Social Security Number was affected and that you are concerned about identity theft. If you receive Social Security benefits, you may be able to place a “block” on your information to make sure that a thief does not redirect your benefit to another address.

Those seeking more information and advice are encouraged to visit the website https://www.maine.gov/moveit-global-data-security-incident/  or call (877) 618-3659, Monday to Friday, 9 AM to 9 PM.

Jane Carpenter is a member of the FBI InfraGard organization, has trained law enforcement in identity theft and data breach response and has helped create laws that assist victims of the crimes.