The Vermont Dept of Financial Regulation Gets Breached, Exposing 42K Residents

The Vermont Department of Financial Regulation is an organization that oversees the financial sector within the state. The department is split into four divisions: Securities, Banking, Captive Insurance, and Insurance. Any businesses involved in these companies must answer to this department, and many Vermont residents have supplied the department with information to help it carry out its everyday role. Anyone that gave data to this organization may be at risk because of a recent data breach within the department. 

How Did the Attack Occur?

The attack on the Vermont Department of Financial Regulation occurred through the MOVEit file transfer solution. The software that's meant to be secure experienced a significant security vulnerability that put all its customers at risk. The software had what's known as a Zero-Day vulnerability, and this allowed hackers to access all the files within the database linked to the software. The department lost a large number of files because of this vulnerability and many people could be at risk for identity theft and phishing attacks. 

What Information Was Viewed or Stolen?

We don't have specifics for the information lost in this data breach. We suspect that personal data was stolen and that full names, Social Security numbers, phone numbers, Driver's License information, home address, email address, and more were also part of the breach. It's likely the information stolen was not the same for all the individuals involved, but if you're named as one of the victims connected with this breach, you should take steps to safeguard yourself from damage. 

How Did the Vermont Department of Financial Regulation Admit to the Breach?

The Vermont Department of Financial Regulation released a notice last week explaining that it experienced a data breach and 42,000 individuals could be impacted by the information released. If any personal information was stolen in this breach, the department will send out individual letters to everyone involved in the breach. At the moment, we don't have specifics about what data was stolen, though, so worried individuals will have to wait for more answers. 

What Will Become of the Stolen Information?

The stolen information will be leveraged to do damage to the people involved in the breach. The main goal of the ransomware gang stealing all this information is to earn money from the stolen information. That means the data will be leveraged for identity theft attacks and resold to other individuals. The information will be leveraged in as many ways as possible to generate money. 

What Should Affected Parties Do in the Aftermath of the Breach?

If you receive information informing you that you are involved in this data breach, you should check your credit and consider investing in credit monitoring services. It's up to you to protect your data; you are at risk of being exposed and damaged by this breach. You should also take care to avoid giving personal information to anyone you don't know and trust via SMS or email messages. Don't supply hackers with your information; it could be leveraged to further harm you.