Work Management Company NSC Tech, Suffers 50k Employee Record Breach

NSC Technologies is a workforce management solution pairing perfect prospective candidates with companies desiring long-term employees. NSC has more than 30 locations nationwide, with the majority in Indiana. They are reportedly a 1% performing acquisition staffing firm; that may change following their recent data breach. 

How Did the Attack Occur? 

NSC’s breach was an external threat that broke into their computer systems. Their consumer notice describes the attack as “suspicious activity” but does not provide details. Consequently, we’re left to wonder how the assailants made the attack possible. Such “sophisticated” cyberattacks may have involved manipulating code past security gates, or they could involve a multi-step social scheme. No matter how the assailants achieved the attack, its consequences are the same—victims must act to protect their data.

What Information Was Viewed or Stolen? 

The stolen information is purportedly limited to full names and Social Security Numbers (SSNs). However, the NSC consumer notice suggests temporary monitoring services applied to individuals’ credit, financial, and identity accounts. Subsequently, although names and SSNs are the only listed impacted data, other private information elements may also be compromised. Those with relationships to NSC or a subsidiary should consider preventative options to defend data from misuse. 

How Did NSC Technologies Admit to the Breach? 

Officials found the breach to have happened around June 19th and the following day. Less than a week later, around June 26th, employees presumably noticed the suspicious activity and notified professionals. An investigation immediately started and concluded around November 1st. However, the Maine breach filing disputes this date, suggesting the event was undiscovered until that day. Following the review’s conclusion, the NSC notified impacted parties and the state generals. 

What Will Become of the Stolen Information? 

It is challenging to say what will happen to the stolen data. The information is limited, and the assailants have presumably not leveraged it with ransomware, but this could change. The thieves could take the data and ransom it to individuals or NSC themselves; they could sell the data in a dark forum, one record at a time, or in bulk; they could even sell it to other criminals—it’s perfect for impersonations or fraudulent plots. Victims can still protect themselves regardless of why the threats stole the data or what they planned for it.

What Should Affected Parties Do in the Aftermath of the Breach? 

The impact figure in the Maine Attorney General’s breach filing is 48,531 people. This data breach will impact those employed with or who have applied to NSC directly or a subsidiary. Impacted subsidiaries include Anistar Technologies, ULG Companies, Superior Resource Group, Staffing Resources, Staff Matters, Nationwide Temporaries, and Consolidated Marine Systems.

There is no evidence of information misuse, but it could be a matter of time for many. NSC suggests monitoring services to mitigate cyber threats, but these aren’t enough to secure all your information. To avoid future cyber threats, take preventative measures now. Enable multi-factor authentications everywhere; update all devices with the newest patches; store and maintain complex passwords within a trusted password manager; and implement alerts and notifications for all account activity. It’s never too late to take control of or protect your data.