Massive Data Breach Hits Maine: Over One Million Residents' Information Compromised in Ransomware Attack

The Maine government has officially acknowledged that personal information of more than one million state residents was compromised in a data breach orchestrated by a ransomware gang linked to Russia earlier this year.

Facing Cybersecurity Breach

Over a million individuals who interacted with Maine state agencies have fallen victim to an international cybersecurity breach orchestrated by a Russian gang. This security incident raises concerns about the potential exposure of sensitive information, including Social Security numbers and dates of birth, for those affected.

According to the released statement, the hackers took advantage of a vulnerability in the MOVEit file-transfer system employed by the Maine government to store sensitive data about state residents. Exploiting this weakness, the cybercriminals successfully accessed and downloaded files from specific state agencies during the period between May 28 and May 29.

The government has announced the revelation of the incident and the initiation of notifications to affected residents following the recent completion of its assessment of the compromised files.

As per the Maine officials, the pilfered information potentially comprises an individual's name, date of birth, Social Security number, driver's license details, and other state or taxpayer identification numbers. Additionally, certain individuals had their medical and health insurance information compromised in the security breach.

The statement highlighted that the state possesses information about residents for diverse purposes, including residency, employment, or interactions with state agencies, and the nature of the data varies for each individual.

In the breakdown of affected agencies, over half of the compromised data pertains to Maine's Department of Health and Human Services, while approximately one-third relates to the Department of Education. The remaining data encompasses various other agencies, such as the Bureau of Motor Vehicles and the Department of Corrections.

However, the government emphasized that the distribution of information is subject to change. According to the U.S. Census Bureau, the state of Maine has a population exceeding 1.3 million people.

Latest Victim Related to MOVEit Mass Hack

The Maine state government has become the latest entity to reveal a breach linked to the extensive MOVEit hack, considered one of the largest cyber incidents of the year based on the sheer number of victims. TechCrunch reported that MOVEit systems serve as file transfer servers, facilitating the secure transfer of sizable and often confidential data over the internet.

Cybersecurity firm Emsisoft, actively monitoring the extensive exploitation, reported that over 2,500 organizations have disclosed data breaches related to MOVEit, impacting at least 69 million individuals. The actual figure is anticipated to be significantly higher as more organizations come forward with their disclosures.

As of the latest update, Emsisoft ranks Maine's security incident as the eleventh largest MOVEit-related breach publicly disclosed. The Portland Press Herald reported that this positions it behind breaches involving Ontario's birth registry, the states of Colorado, Oregon, and Louisiana, as well as the U.S. government contractor Maximus.

Notably, several U.S. federal agencies, including the Department of Energy, were also impacted by this cyber threat. Despite the extensive list of MOVEit-related victims on the Clop gang's leak site, Maine has not been featured thus far. Ransomware groups often release portions of stolen files to pressure organizations into paying ransoms.