Breach notification letters have been sent out to 5,810 current and former employees of the Colonial Pipeline who had their personal information accessed by the DarkSide ransomware group back in May of this year.
In these letters, the company admitted that the ransomware group was able to acquire “certain records” stored on its systems during the now infamous cyberattack that occurred as the result of a compromised VPN password.
According to Colonial Pipeline, the cybercriminals managed to obtain employees' full names, contact information, dates of birth, government-issued IDs and health-related information. However, it's worth noting that not every employee had all of this information exposed.
- We've built a list of the best data loss prevention services available
- These are the best identity theft protection solutions on the market
- Also check out our roundup of the best password managers
In addition to encrypting the company's systems, the DarkSide ransomware group also managed to steal around 100GB of data in a typical double-extortion ploy used by virtually all ransomware operators these days.
Employee information exposed
The news that Colonial Pipeline has begun sending out data breach notification letters to its current and former employees was first reported by BleepingComputer. Additionally, in a statement to CNN Business, a company spokesperson confirmed that personal information was stolen during the attack.
In order to make up for losing employee's sensitive personal and health information, Colonial Pipeline is providing affected employees with identity theft protection and credit monitoring services from Experian IdentityWorks. However, employees will need to sign up for the service by October, 31 of this year to take advantage of the offer.
At the same time though, Colonial Pipeline is also advising employees to keep a close eye on their credit reports and look out for any unusual activity.
The cyberattack on Colonial Pipeline has served as a wake up call both for private businesses and for the US government. In fact, since the attack took place in May, the US government has passed multiple new regulations for critical industries to help prevent them from falling victim to similar attacks going forward.
- We've also highlighted the best security key
Via ZDNet
