The same hackers who stole $6 million from the city last year also obtained access to birth dates, Social Security numbers, financial account numbers, and other “personal information” of hundreds of city employees, retirees, and contractors.
City spokesperson Lenny Speiller and public schools spokesperson Justin Harmon made that announcement in a Tuesday afternoon email press release.
The public notice of the “privacy incident” comes a year to the month after hackers impersonating a school bus contractor tricked school district and city officials into sending them roughly $6 million in public funds.
According to the Elicker administration, the city has already recovered or “is scheduled to receive” roughly $5.1 million of those stolen funds.
Tuesday’s update, meanwhile, reveals another dimension to last year’s cyberattack — going beyond the theft of public money, and into the realm of at least the exposure of “personal information” of city employees and others.
The press release states that a city-hired “forensic investigation firm” found “unauthorized access to City email accounts containing personal information from June 1, 2023 through June 18, 2023.”
An “e‑discovery firm” then searched through affected email accounts, and found that “personal information belonging to 404 individuals could have been accessed. These individuals include city employees, retirees, vendors, and others.”
The personal information that could have been accessible to these hackers, meanwhile, included “names, dates of birth, Social Security numbers, driver’s license numbers, financial account numbers, individual tax identification numbers, health insurance information, and/or medical information.”
The press release continued by stating that the city is “not aware of any fraud or identity theft to any individual as a result of this incident, but nonetheless is notifying potentially involved individuals to provide them with more information and resources.”
Letters are being mailed to 334 individuals for which the city has contact info. Notice has also been posted to the city’s website here to try to reach those for whom the city does not have contact info.
Impacted individuals seeking additional information may call a confidential, toll-free inquiry line at 888 – 326-0947 from 9 a.m. to 9 p.m. EST, Monday – Friday excluding major U.S. holidays.
The press release concludes by noting that, since last year’s cyberattacks, the city has hired a chief technology officer and has engaged several contractors “that have reviewed its cybersecurity and financial procedures and are working with the City to implement these improvements.”