Malware at Massachusetts Unemployement Office Leads to Data Breach
Modernizing Authentication — What It Takes to Transform Secure Access
Cyber-criminals may have used malware to steal personal information from the Massachusetts unemployment offices, according to the state agency.
As many as 1,500 computers in the Departments of Unemployment Assistance and Career Services were infected with a virus beginning April 20, the Massachusetts Executive Office of Labor and Workforce Development said on May 17. Computers in the mobile One Stop Career Centers that work with claimants were also infected.
Even though EOLWD immediately worked with Symantec to remove the malware, W32.QAKBOT, it learned on May 16 that the infection hadn't been "remediated as originally believed," leading to a data breach.
"I apologize to our customers and recognize that this is an unwanted problem," Joanne F. Goldstein, Secretary of Labor and Workforce Development said in a statement.
W32.QAKBOT is a worm that spreads through network drives and removable drives, according to the Symantec's Security Response page. After the initial infection, usually the result of clicking on a malicious link on a Web page, it can download additional files, steal information and open a back door on the compromised machine. The worm also contains a rootkit that allows it to hide its presence and it works slowly to avoid detection. "Its ultimate goal is clearly theft of information," said Shunichi Imano, a Symantec researcher.
There is a "possibility" the virus collected confidential claimant or employer information, such as names, Social Security numbers, Employer Identification Numbers, email addresses, and residential or business addresses. The affected system also contained bank information of employers.
"These days, whenever I hear of a big corporate infection that's very hard to get rid of and people are struggling, I immediately think of Qakbot," Roel Schouwenberg, an antivirus researcher at Kaspersky Lab, told WBUR, a Boston NPR radio station.
Qakbot is especially aggressive and normally targets online banking, although it has the ability to mutate itself to switch targets and change its methods. The cyber-criminals behind the infection could have remotely instructed the virus to go after names, addresses and Social Security numbers stored in the state systems instead of focusing on banking sites, Schouwenberg said.
"Only" the 1,200 employers that file their quarterly statements manually with the departments could be impacted, according to the EOLWD. Goldstein was "hopeful" that the actual impact on businesses and residents was "minimal." Most of the 180,000 businesses tend to file online and are likely not affected.
For more, read the eWEEK article: Virus Causes Data Breach at Massachusetts Unemployment Agency.