San Bernardino County's Housing Authority says June data breach impacted close to 20,000 residents

The Housing Authority of the County of San Bernardino, America’s largest county, said the cyber attack it suffered last year compromised the sensitive personal information of almost 20,000 individuals.

The County of San Bernardino is America’s largest county by area and is located in the Greater Los Angeles area. It has a total land area of more than 52,000 square kilometres and has a population of more than two million people.

In a recent filing with the Office of the Maine Attorney General, the Housing Authority of the County of San Bernardino (HACSB) said that on June 19, it discovered unauthorised access to an employee’s official email account.

The Housing Authority immediately launched an internal investigation with assistance from third party cyber security experts to understand the nature and scope of the cyber security incident and performed a mandatory password change to the compromised email account.

“Upon confirmation of unauthorised access to the employee email account, HACSB immediately investigated whether the affected account contained sensitive information pertaining to individuals. Following a thorough review, HACSB confirmed that a limited amount of information may have been accessed by an unauthorised third-party in connection with this incident,” it said.

The compromised data included the names and other personal identifiers in combination with the Social Security Numbers of County residents. The filing with the regulator also revealed that at least 18,689 individuals were impacted by the data security incident.

“HACSB has taken steps to address the incident and is committed to protecting personal information in its care. Upon learning of this incident, we immediately took steps to secure our email tenant and undertook a thorough investigation,” HACSB added.

The housing authority added that it found no evidence of the compromised data being misused. However, as a precaution, it has urged all impacted members to remain vigilant and monitor their credit reports and financial statements for suspicious transactions.

HACSB is offering a year of complimentary credit monitoring and identity protection services via IDX to all the individuals affected by the security incident.

In April last year, the Sheriff’s Department of San Bernardino County also suffered a cyber security incident that disrupted its daily operations and forced it to temporarily take its systems offline to mitigate the impact of the attack.

David Wert, Public Information Officer of San Bernardino County, later said that the cybersecurity incident was a ransomware attack. “The network disruption within the San Bernardino County Sheriff’s Department was the result of ransomware that infected portions of the department’s information technology system,” he said.

County officials confirmed that they paid $1.1 million as ransom to the threat actors to get the Sheriff’s Department’s systems decrypted. According to Wert, the County was prepared for incidents like this and had sought appropriate insurance coverage to deal with such scenarios.