Cyber attack on debt relief company Set Forth impacted about 1.5 million individuals

Schaumburg, Illinois-based debt relief solutions provider Set Forth said that the data security incident it suffered earlier this year compromised the sensitive personal information of about 1.5 million individuals.

 

In a data security incident notification filed with the Office of Maine Attorney General, Set Forth said that on May 21, it identified suspicious activity in its internal network. The company immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

“The investigation determined that personal information belonging to yourself, a spouse, co-applicant, or dependent may have been accessed during the incident,” it said.

 

The compromised data included names, addresses, dates of birth, and social security numbers. The company said in its filing with the Maine state regulator that it has identified at least 1.5 million individuals who were impacted by the incident.

 

“Data security is one of our highest priorities. We want to assure you that we are taking steps to prevent a similar incident from happening in the future. Since the incident, we deployed enhanced endpoint monitoring software, performed a global password reset, and implemented additional security controls,” Forth added.

 

While the debt relief solution provider found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general.

 

It has also offered one year of complimentary identity protection and credit monitoring services through Cyberscout to all affected individuals.

 

The company, in its data security incident notice, did not share details on who is responsible for the cyber attack or how the threat actors infiltrated its internal network. Also, at the time of publishing, no known hacker group has claimed responsibility for the cyber attack, nor has the company stated whether it received a ransom demand.