Pennsylvania township says ransomware attack compromised residents' personal data

Upper Merion Township in Montgomery County, Pennsylvania, said that the data security incident it suffered last year compromised the sensitive personal information of its residents.

 

In a filing with the Office of Attorney General of Vermont, the township said that on December 27, it identified unauthorised activity in its internal network and immediately launched an investigation with assistance from external cyber security experts to determine the nature and scope of the incident.

 

As a precaution and to mitigate the risk of the incident, Township officials took several systems and platforms offline, including the email service, severed phone connectivity and notified law enforcement about the incident.

“After an investigation and review of the impacted data, we discovered on August 9, 2024, that the files accessed and/or acquired by the unauthorised actor contained some of your protected personal information,” the township wrote in a letter to affected residents, adding that the compromised data included their names and other personal identifiers.

 

While the Township found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general.

 

It has also offered complimentary identity protection and credit monitoring services to all affected individuals.

 

In January, the Qilin ransomware group claimed responsibility for the cyber attack on Upper Merion Township and listed it as a victim on its data leak site. The group claimed to be in possession of 500 GB of data stolen from the township, including private contracts, emails, and financial documents.

 

The group also shared samples of the stolen document to prove the authenticity of its claims.

 

Upper Merion Township is yet to share details on how Qilin infiltrated its network, how much the hacker group demanded as ransom or whether it paid the amount. The township is also yet to share the number of affected individuals.