About the Accellion data security breach
The process is under way to notify people whose unemployment benefits claims information may have been affected by a data security breach of the Accellion file transfer service.
The notifications are being sent by e-mail to people who received unemployment benefits from the State of Washington in the 2017 to 2020 time period. The e-mail will contain information about identity theft protection and an individual code for 12 months of free credit monitoring and instructions on how to enroll and request assistance. If you don’t receive an email by March 15, please click below under “Legal notice about the data incident” then “Offer of free credit monitoring / identify theft protection services” for more information.
The Office of the Washington State Auditor will update this page as this process proceeds.
Legal notice about the data incident (Updated: 3/4/21)
This section is also available in these languages (Important: March 4 information coming soon):
ኣማርኛ – Amharic | العربية – Arabic | Khmer (ភាសាខ្មែរ) – Cambodian | 简体中文 – simplified Chinese | (fārsī) فارسى – Farsi (Persian) | 한국어 [韓國語] – Korean | ພາສາລາວ (pháasaa láo) – Lao | Afaan Oromo – Oromo | ਪੰਜਾਬੀ / ﺏﺎﺠﻨﭘ (panjābi) – Punjabi | Русский – Russian | af Soomaali – Somali | Español – Spanish | Tagalog – Tagalog | Tiếng Việt – Vietnamese
Frequently asked questions (Updated: 3/4/21)
Is This Notice Available in Other Languages? Yes, this notice is available in these languages: ASL ኣማርኛ – Amharic | العربية – Arabic | Khmer (ភាសាខ្មែរ) – Cambodian | 简体中文 – simplified Chinese | (fārsī) فارسى – Farsi (Persian) | 한국어 [韓國語] – Korean | ພາສາລາວ (pháasaa láo) – Lao | Afaan Oromo – Oromo | ਪੰਜਾਬੀ / ﺏﺎﺠﻨﭘ (panjābi) – Punjabi | Русский – Russian | af Soomaali – Somali | Coming soon: Español – Spanish | Tagalog – Tagalog | Tiếng Việt – Vietnamese.
What Happened? In mid-January of 2021, SAO was alerted to a potential security incident involving the Accellion file transfer service. SAO immediately contacted Accellion for specific details. Over the next few weeks, SAO learned that an unauthorized person gained access to data stored in SAO’s file transfer account with Accellion. SAO began working with Accellion to identify which files may have been impacted by the incident. The incident is under active investigation by Accellion, SAO, and law enforcement.
What Information Was Involved? Some of the data files identified by Accellion contained personal information of individuals, among others, who received unemployment benefits from the Employment Security Department (“ESD”) in the 2017 to 2020 time period. These files may have contained the person’s name, Social Security number, date of birth, street and email addresses, bank account number and bank routing number. The Accellion service was not managed by ESD and ESD bears no responsibility for this data breach and is not in a position to respond to calls or questions about this matter.
Our Response. As soon as SAO became aware of the incident, SAO immediately contacted Accellion to understand the scope and nature of the incident and the impact on our data files. Once Accellion began to identify the affected files, SAO mobilized its team to both assess the data files that were impacted and the security of SAO’s network. SAO is working with cybersecurity experts and, to date, has found no indication of compromise to its network.
General tips if you are concerned (Updated: 2/9/21)
SAO is working swiftly to mitigate the harm caused by this crime. This includes help for people whose personal information is at risk. SAO will notify those people as quickly as possible.
We will add information to this webpage as we learn more and as the authorities investigating the incident recommend we do so.
The Washington Office of Financial Management has information for state employees whose data may have been involved in this data breach.
Two additional Washington agencies have established webpages providing more general advice about protecting yourself from identity theft.
- The Department of Financial Institutions’ webpage for consumers is at: https://dfi.wa.gov/consumers/data-breach-resources . It contains a useful checklist of Steps to Take After a Data Breach to Protect Your Financial Accounts from Fraud (PDF).
- The Attorney General’s Office also highlights the kinds of attacks consumers should be wary of following a data security incident that might have exposed personal data, including common scams. https://www.atg.wa.gov/identity-theftprivacy.
Finally, the Federal Trade Commission publishes a helpful website full of information to help you take action if you suspect your personal information may have been exposed in a data breach at: https://www.consumer.ftc.gov/topics/identity-theft.
Among the suggestions the FTC makes are three actions you can take today to protect your identity.
1. Contact the three major credit-reporting bureaus and place a fraud alert on your name. This will alert you if anyone tries to use your personal information to open an account in your name. The links below are to the personal credit reporting pages of these three companies.
- Equifax – https://www.equifax.com/personal/
- Experian – https://www.experian.com/consumer-products/identity-theft-and-credit-protection.html
- TransUnion – https://www.transunion.com/
2. Change and strengthen passwords and security questions/answers on financial, medical and other important websites you use regularly. Consider adding two-step identify verification (such as confirming a login with a text-message or PIN).
3. Monitor your identity and accounts carefully. Watch for unusual activity or transactions.
What is SAO doing about the incident
SAO is working closely with affected parties. In addition, we are in touch with state cybersecurity officials, law enforcement and legal counsel.
We are continuing to investigate the incident, to see if any other data might have been accessed. Of course, we will continue to follow state law and notify the individuals whose information could be vulnerable.
We will continue to provide as much information as we can as the investigation moves forward. SAO is also evaluating other tools and protocols for sharing data files in the future.
Other information (Updated: 2/8/21)
- Press release: Third-party service provider’s security incident compromised Washingtonians’ personal information
- TVW webcast of Auditor McCarthy’s conversation with journalists on February 1, 2021
- Accellion Data Breach Response | WSECU
- Accellion Data Security Breach | BECU
- Security Update: State of Washington Data Breach | OlyFed
- Washington State Auditor Data Breach | White River Credit Union
- Washington State Auditor Data Breach | Sound Credit Union
- Washington State Auditor’s Office Data Breach | Canopy Credit Union
- Are you impacted by the Accellion data breach? | TwinStar Credit Union
- Washington State Auditor’s Office Data Breach | Verity Credit Union