skip to main content

About the Accellion data security breach

The process is under way to notify people whose unemployment benefits claims information may have been affected by a data security breach of the Accellion file transfer service.

The notifications will be sent by e-mail during the next two weeks to people who filed an unemployment insurance claim in 2020. The e-mail will contain information about identity theft protection and an individual code for 12 months of free credit monitoring and instructions on how to enroll and request assistance.

The Office of the Washington State Auditor will update this page as this process proceeds.

Legal notice about the data incident (Updated: 2/25/21)

This section is also available in these languages:

ኣማርኛ – Amharic |  العربية – Arabic | Khmer (ភាសាខ្មែរ) – Cambodian | 简体中文 – simplified Chinese | (fārsī) فارسى – Farsi (Persian) | 한국어 [韓國語] – Korean | ພາສາລາວ (pháasaa láo) – Lao |  Afaan Oromo – Oromoਪੰਜਾਬੀ / ﺏﺎﺠﻨﭘ (panjābi) – PunjabiРусский – Russian | af Soomaali – Somali | Español – Spanish  | Tagalog – Tagalog | Tiếng Việt – Vietnamese

Introduction

The Office of the Washington State Auditor (“SAO”) was recently made aware of a data security incident involving Accellion, a third-party provider of hosted file transfer services. This incident may have involved some of the personal information you included in your unemployment benefits claim filed in 2020.

Although we have no evidence that any of your information has been misused, we are providing this notice about the incident to you, and other potentially affected people, and providing tools and resources you can use to protect yourself against identify theft or fraud.

We also are offering one year of credit monitoring at no cost to you.

We take data security seriously and are committed to protecting the privacy of personal information entrusted to us.  Over the course of the next several days, you should be receiving an email notification from SAO with information about the incident and specific instructions for signing up for credit monitoring with Experian.  Please follow the instructions in that email to sign up for credit monitoring.  If you filed for unemployment benefits in 2020, but have not received an email by March 9, 2021, you may follow the directions below to sign up for Experian’s credit monitoring.  We encourage you to take advantage of Experian’s monitoring product and identity restoration service, which are provided to you free of charge.

We deeply regret any concern or inconvenience this matter may cause. If you have any questions, please don’t hesitate to call our dedicated call center at 1-855-789-0673 Monday – Friday from 8:00 a.m. – 5:00 p.m. Pacific Time.

Sincerely,

Pat McCarthy Washington State Auditor

Frequently asked questions

Is This Notice Available in Other Languages?  Yes, this notice is available in these languages: ኣማርኛ – Amharic |  العربية – Arabic | Khmer (ភាសាខ្មែរ) – Cambodian | 简体中文 – simplified Chinese | (fārsī) فارسى – Farsi (Persian) | 한국어 [韓國語] – Korean | ພາສາລາວ (pháasaa láo) – Lao |  Afaan Oromo – Oromo | ਪੰਜਾਬੀ / ﺏﺎﺠﻨﭘ (panjābi) – Punjabi | Русский – Russian | af Soomaali – Somali | Español – SpanishTagalog – Tagalog | Tiếng Việt – Vietnamese.

What Happened? In mid-January of 2021, SAO was alerted to a potential security incident involving the Accellion file transfer service. SAO immediately contacted Accellion for specific details. Over the next few weeks, SAO learned that an unauthorized person gained access to data stored in SAO’s file transfer account with Accellion. SAO began working with Accellion to identify which files may have been impacted by the incident. The incident is under active investigation by Accellion, SAO, and law enforcement.

What Information Was Involved? The data files identified by Accellion contained personal information of individuals, among others, who filed unemployment benefit claims in 2020 with the Employment Security Department (“ESD”). These claims files may have contained the person’s name, social security number, date of birth, street and email addresses, bank account number and bank routing number. The Accellion service was not managed by ESD and ESD bears no responsibility for this data breach and is not in a position to respond to calls or questions about this matter.

Our response: As soon as SAO became aware of the incident, SAO immediately contacted Accellion to understand the scope and nature of the incident and the impact on our data files. Once Accellion began to identify the affected files, SAO mobilized its team to both assess the data files that were impacted and the security of SAO’s network. SAO is working with cybersecurity experts and, to date, has found no indication of compromise to its network.

Offer of free credit monitoring/Identity theft protection services

SAO is making 12 months of free credit monitoring and identity restoration services through Experian available to you. Due to privacy laws, we are not able to enroll you directly. The program has two components, described below.

Credit Monitoring.A free 12-month membership to Experian IdentityWorks Credit 3B. This product helps detect possible misuse of your personal information by monitoring all three major credit agencies and provides you with identity protection services focused on immediately identifying and resolving identity theft. IdentityWorks Credit 3B is completely free to you and enrolling in this program will not hurt your credit score.

Identity Restoration.If you suspect fraudulent use of your information or identity theft, and would like to discuss how to resolve those issues, you may reach out to an Experian agent using the contact information for Experian below. This service is available to you for one year and does not require you to enroll or take any other action at this time. If, after discussing your situation with an agent, it is determined that identity restoration support is needed, an Experian Identity Restoration agent will be available to work with you to investigate and resolve each incident of fraud that occurred from the date of the incident (including, as appropriate, helping you with contacting creditors to dispute charges and close accounts; assisting you in placing a freeze on your credit file with the three major credit bureaus; and assisting you with contacting government agencies to help restore your identity to its proper condition).

* Offline members will be eligible to call for additional quarterly reports after enrolling.

** The Identity Theft Insurance is underwritten and administered by American Bankers Insurance Company of Florida, an Assurant company. Please refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may not be available in all jurisdictions.

How to Enroll in Experian Credit Monitoring

If you Receive an Email from SAO with a Personalized Activation Code:  You can sign up for the 12 months of free credit monitoring/identity restoration program through Experian using your personal Enrollment Activation Code provided in the email you received from “Washington State Auditor Incident Response”.  For more information visit www.experianidworks.com/3bcredit.

With your personalized Activation Code, you can also call Experian directly to enroll in the program using this toll-free number: 1-833-256-3154. Representatives are available to assist you and answer questions about the program Monday through Friday from 6:00a.m.-8:00p.m. PST and Saturday/Sunday 8:00a.m.-5:00p.m. PST.

If You Filed For Unemployment Benefits in 2020 But do Not Receive an Email with a Personalized Activation Code by March 9, 2021, you can enroll in Experian’s credit monitoring by following these instructions:

1.            Visit www.experianidworks.com/3bcredit or call Experian directly to enroll in the program using the toll-free number:  1-833-256-3154,

2.            You will need to provide the code: WSHAUD2021.

3.            You will need to provide the engagement number:  B009702

4.            Enrollment will be open until 6/6/2021.

Additional Details Regarding Your 12-MONTH EXPERIAN IDENTITYWORKS Credit 3B Membership:

A credit card is not required for enrollment in Experian IdentityWorks Credit 3B.

You can contact Experian immediately—without needing to enroll—regarding any fraud issues. Identity Restoration specialists are available to help you with credit and non-credit related fraud.

Once you enroll in Experian IdentityWorks, you will have access to the following additional features:

Experian credit report at sign-up: See what information is associated with your credit file. Daily credit reports are available for online members only.*

Credit Monitoring: Actively monitors Experian, Equifax and TransUnion files for indicators of fraud.

Experian IdentityWorks ExtendCARETM: You receive the same high-level of Identity Restoration support even after your Experian IdentityWorks membership has expired.

$1 Million Identity Theft Insurance**: Provides coverage for certain costs and unauthorized electronic fund transfers.

Additional steps you can take to protect your personal information

Review Your Account Statements and Notify Law Enforcement of Suspicious Activity: As a precautionary measure, we recommend that you remain vigilant and review your account statements and credit reports closely. If you detect any suspicious activity on an account, you should promptly notify the financial institution or company with which the account is maintained. You should also promptly report any fraudulent activity or any suspected incidence of identity theft to proper law enforcement authorities, your state attorney general, and/or the Federal Trade Commission (“FTC”).

Copy of Credit Report: You may obtain a free copy of your credit report from each of the three major credit reporting agencies once every 12 months by visiting www.annualcreditreport.com/, calling toll-free 877-322-8228, or by completing an Annual Credit Report Request Form and mailing it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348. You can also contact one of the following three national credit reporting agencies:

Equifax

P.O. Box 105851 Atlanta, GA 30348

1-800-525-6285

www.equifax.com

Experian

P.O. Box 9532 Allen, TX 75013

1-888-397-3742

www.experian.com

TransUnion

P.O. Box 1000 Chester, PA 19016

1-877-322-8228

www.transunion.com

Fraud Alert: You may want to consider placing a fraud alert on your credit report. An initial fraud alert is free and will stay on your credit file for one year. The alert informs creditors of possible fraudulent activity within your report and requests that the creditor contact you prior to establishing any accounts in your name. To place a fraud alert on your credit report, contact any of the three credit reporting agencies identified above. Additional information is available at www.annualcreditreport.com.

Security Freeze: In the State of Washington and some other states, you have the right to place a security freeze on your credit file. This will prevent new credit from being opened in your name without the use of a PIN that is issued to you when you initiate the freeze. A security freeze is designed to prevent potential creditors from accessing your credit report without your consent. As a result, using a security freeze may interfere with or delay your ability to obtain credit. You must separately place a security freeze on your credit file with each credit reporting agency. There is no fee to place, lift or remove the security freeze. In order to place a security freeze, you may be required to provide the consumer reporting agency with information that identifies you, including your full name, Social Security number, date of birth, current and previous addresses, a copy of your state-issued identification card, and a recent utility bill, bank statement or insurance statement.

Additional Free Resources: You can obtain information from the consumer reporting agencies, the Federal Trade Commission or from your state Attorney General about steps you can take toward preventing identity theft. You may report suspected identity theft to local law enforcement, including to the FTC or to the state Attorney General. Here is the contact information for the FTC:

Federal Trade Commission, 600 Pennsylvania Ave, NW, Washington, DC 20580 www.consumer.ftc.gov, and www.ftc.gov/idtheft

1-877-438-4338

You also have certain rights under the Fair Credit Reporting Act (FCRA): These rights include knowing what is in your file; disputing incomplete or inaccurate information; and requiring consumer reporting agencies to correct or delete inaccurate, incomplete, or unverifiable information. For more information about the FCRA, please visit www.consumer.ftc.gov/articles/pdf-0096-fair-credit-reporting-act.pdf.

Frequently asked questions (Updated: 2/25/21)

Is This Notice Available in Other Languages? Yes, this notice is available in these languages: ASL ኣማርኛ – Amharic |  العربية – Arabic | Khmer (ភាសាខ្មែរ) – Cambodian | 简体中文 – simplified Chinese | (fārsī) فارسى – Farsi (Persian) | 한국어 [韓國語] – Korean | ພາສາລາວ (pháasaa láo) – Lao |  Afaan Oromo – Oromoਪੰਜਾਬੀ / ﺏﺎﺠﻨﭘ (panjābi) – PunjabiРусский – Russian | af Soomaali – Somali | Coming soon: Español – Spanish  | Tagalog – Tagalog | Tiếng Việt – Vietnamese.

What Happened? In mid-January of 2021, SAO was alerted to a potential security incident involving the Accellion file transfer service. SAO immediately contacted Accellion for specific details. Over the next few weeks, SAO learned that an unauthorized person gained access to data stored in SAO’s file transfer account with Accellion. SAO began working with Accellion to identify which files may have been impacted by the incident. The incident is under active investigation by Accellion, SAO, and law enforcement.

What Information Was Involved? The data files identified by Accellion contained personal information of individuals, among others, who filed unemployment benefit claims in 2020 with the Employment Security Department (“ESD”). These claims files may have contained the person’s name, social security number, date of birth, street and email addresses, bank account number and bank routing number. The Accellion service was not managed by ESD and ESD bears no responsibility for this data breach and is not in a position to respond to calls or questions about this matter.

Our Response. As soon as SAO became aware of the incident, SAO immediately contacted Accellion to understand the scope and nature of the incident and the impact on our data files. Once Accellion began to identify the affected files, SAO mobilized its team to both assess the data files that were impacted and the security of SAO’s network. SAO is working with cybersecurity experts and, to date, has found no indication of compromise to its network.

General tips if you are concerned (Updated: 2/9/21)

SAO is working swiftly to mitigate the harm caused by this crime. This includes help for people whose personal information is at risk. SAO will notify those people as quickly as possible. 

We will add information to this webpage as we learn more and as the authorities investigating the incident recommend we do so.

The Washington Office of Financial Management has information for state employees whose data may have been involved in this data breach.

Two additional Washington agencies have established webpages providing more general advice about protecting yourself from identity theft.

Finally, the Federal Trade Commission publishes a helpful website full of information to help you take action if you suspect your personal information may have been exposed in a data breach at: https://www.consumer.ftc.gov/topics/identity-theft.

Among the suggestions the FTC makes are three actions you can take today to protect your identity.

1. Contact the three major credit-reporting bureaus and place a fraud alert on your name. This will alert you if anyone tries to use your personal information to open an account in your name. The links below are to the personal credit reporting pages of these three companies.

2. Change and strengthen passwords and security questions/answers on financial, medical and other important websites you use regularly. Consider adding two-step identify verification (such as confirming a login with a text-message or PIN).

3. Monitor your identity and accounts carefully. Watch for unusual activity or transactions.

What is SAO doing about the incident

SAO is working closely with affected parties. In addition, we are in touch with state cybersecurity officials, law enforcement and legal counsel.

We are continuing to investigate the incident, to see if any other data might have been accessed. Of course, we will continue to follow state law and notify the individuals whose information could be vulnerable.

We will continue to provide as much information as we can as the investigation moves forward. SAO is also evaluating other tools and protocols for sharing data files in the future.